Can another user complete a task when it's already assigned?

Is it possible for a user (who might be in the same candidate group) to complete a task that’s has been assigned to another user (in the same group)?

Through the Java API’s yes, as there’s no check being done there on these things.

Experiencing otherwise. It is possible for this to happen through the REST API as we’re experiencing.
We’re using version 6.4.2.

And just to check, the user isn’t admin?

No. The user is not admin.

The REST API is similar to the Java API, as such it doesn’t do any extra checks vs the Java API.