The data displayed in LEM is what was contained in the original event on the originating device / node.
You may have to look at the source to see if there is a configuration to display the username instead of asterisks.
LEM does not modify the data in any way other than to normalize the format.