Encountering issue with GlideRecord in scoped application

Hi All, I have been working on the inbound actions in CSM and encountered one issue.

Let's say there are multiple contact records with the same email id abc@xyz.com, the user only has snc_external role in all the records. When the user sends the email, we want to check that this user has multiple contacts and then process something.

Now, we wrote a glide record on the contact table in the inbound action(tried business rule as well), then based on the row count we get, we are processing the rest of the things. Sounds straight forward, right?

But the problem we are facing is, it always returns only 1 record no matter how many contacts there are with the same email id. On exploring further we found it to be an access issue such that the user can only read their own record.

As per guidelines, on the GlideRecord query, ACLs don't apply, but somehow it is being applied in our scenario.

We found alternative solutions to it, like using impersonation in the BR or updating the ACLs. 

But I was wondering why the OOB function is not working in this case.

All of this is happening in the scoped app CSM. 

It will be really great if someone can please help us with this.

Thanks

Code is as below:

Running as before business rule in the sn_customerservice_case table

var contactID = new GlideRecord ('customer_contact');
contactID.addQuery('email', current.u_email);
contactID.query();

var newCount = contactID.getRowCount();

if (newCount == 1 ){
contactID.next()
gs.log('********Only 1 record');
}
else
{
gs.log('********more than 1 record');

}