While I don't know for sure, I would expect a User Event triggered by a SOAP request would execute with the same credentials sent in the request, and would thus be able to invoke a Suitelet accordingly - provided the Suitelet was accessible by that user/role