The username "dr.who" is the default identity of anyone connecting to HDFS
or YARN via the web server (REST) APIs in an unsecured, non-kerberos
cluster where a connecting user's identity cannot be authentically
determined.
If your cluster is exposed to the internet, and/or you are unable to
recognize any of these jobs, I'd recommend shutting down the service
immediately and investigating a possible external attack. I'd also strongly
recommend following:
https://blog.cloudera.com/blog/2017/01/how-to-secure-internet-exposed-apache-hadoop/and securing your cluster in such a deployment.