When you add a user in unix, ever notice how it doesn't prompt you for a password? Try it: useradd testuser. Didn't ask did it? Just gave you a new command prompt. Congratulations, now you have a user with no password.
Of course, you can't log in using the user until you set a password for it, so it's not much of a security hole. This is the reason the mysql user is set up with no password: if it HAD a default password it would be a MASSIVE security hole, because you'd be able to log in using that user and have rights over the database.
If you look in your /etc/shadow file, you should see the user with a ! where the password would otherwise be. Means the account is locked.