garbage.sh contains only this one line and the cronjob was created with "crontab -e"
One thing comes to my mind: Maybe there are some credentials "cached" so the "su - user"
done internally by cron will "simply" mount the encrypted home and then execute the script.
This will probably be visible, if you add a "sleep 30" as first line.
So garbage.sh would look like: