Why I can end up with a request assigned to someone who isn't in the assigned group ?
The "Assignee" field in a new request will automatically be filled in with the current user, if the "Assignee_set" option is installed, as long as the user if an Analyst.
The "Group" field in a new request will automatically be filled in, based on the Group in the Request Area definition, if the "Area_defaults" option is installed.
If the "Assignee" field in the request area is left blank, and both of these options are installed, when a request is created, the assignee will automatically contain the logged in user, and the group will be the group from the request area definition. There is no check to see if the assignee is in the selected group, so you can end up with a request assigned to someone who isn't in the assigned group. However, If you enter the request area and then tab to the assignee field and search for assignees, the list of possible assignees is generated from the group membership list.
This is expected behaviour. There is no validation done between the "Assignee" and "Group" fields, if they are both automatically filled in because the two options (Area_defaults and Assignee_set) are installed. You can un-install one of the options (which one obviously depends on your business requirements), or alternatively make sure that the person creating the ticket tabs to the assignee field, blanks it out and then selects an assignee from the pick list, which will be only be populated by contacts who are in the assigned group.