Remote access attibute is a list of remote users that are allowed to recover this client's files. If empty, only users logged into this machine are valid.
Examples: sam@jupiter or user=sam,host=jupiter (user sam on machine jupiter), group=wheel,host=jupiter (any user in group wheel on host jupiter), jupiter or host=jupiter (any user on machine jupiter).
Check in your environment what is the user &legato_restore , this is not a NetWorker related, it is a user you have in your environment, you can check if this user allowed only for recovery on that client or it is useless here to specify that user.
Hope this helps you.
You can refer the following knowledge base article for additional information about Remote access attribute of the Client configuration .
As far as I know there are no automatic entries created in the remote access field when creating a client, so most likely that entry has been added manually by some of the administrator's or some other user while attempting to perform a restore.
If enabled, you can check the rap log (/nsr/logs/rap.log) this will report any changes performed in the configuration of NMC.
Enabling the rap logging now will mean that all changes will be logged from now, but will not tell you who changed this value in the past. If it was not enabled at the time of the change, you are not going to be able to tell who put that entry there.