You do have an input parameter account. Thus the calling event must pass an account object; an object from a page when called by a button or passed by the calling main microflow etc.. In all cases you already have your account object. So your retrieve should be [id = $Account]
Your current XPath just evaluates if the input parameter passes an object of account which equals the $CurrentUser object. Return on this XPath is true, but does not constrain the data retrieved. The retrieve just returns the first of the list of accounts from the database. ;-)
if you want to retrieve the account, you can try below to see the correct result.