Why can my new user login as sysdba in oracle?
Your windows user is part of the dba group (oradba). It uses Windows authentification to connect as sysdba. See this thread on AskTom:
"as sysdba" is extremely powerful, it uses OS AUTHENTICATION, it does not require database authentication (it is used to login before there is a "database" or even an "instance"!)
As a member of the dba group, you can login as sysdba with any database user. You can even login without a user: sqlplus / as sysdba.
This is how I would normally create a new user:
create user &1 identified by &2 default tablespace &3 temporary tablespace &4;
grant connect, resource to &1;grant alter session to &1;
** get the picture; also include other default privileges like "create ... " : sequence, synonym, table, view, database link select_catalog_role etc.