USER is generally exported on login but is not read-only -- something could conceivably have changed or unset it before you get to that point. That would be far more likely than expansion being "broken".
grep did not match any "UNF\1122" in the ps output because none of the ps output contained "UNF\1122".
I am not sure what \1122 is supposed to be, but it's some unicode character you may not have noticed because it's probably unprintable in your terminal.
Make sure that it's not actually in your user name:
You said you were in an Ubuntu box. The env USER should be set to just the name of the account you're logged in. Somewhat, it has been set to that "UNF\1122", unless that that's the name of the account.
Check what's the user name:
grep UNF /etc/passwd | od -bc
Log out and log in again and check once more for env
That's a bit short-sighted from the part of who decided to have that scheme of username. The `\' is special to the shell. It is used as the escape character. That's why the original command would not work:
If USER="UNF\\\\1122" or USER='UNF\\1122' , then that command might work
That's the file awk was looking at. It must be there.
I'm surprised he was able to put that in a username, really. From man useradd:
Usernames must start with a lower case letter or an underscore,
followed by lower case letters, digits, underscores, or dashes. They
can end with a dollar sign. In regular expression terms:
[a-z_][a-z0-9_-]*[$]?