As a first; double check your permission set up. You MIGHT have missed something.
I seem to remember that the LEAST restrictive applies on a profile, and it could be there that you have a cross over.............

Cannot remember when it goes to the MOST restrictive. Presumably, the user has just slotted the CD in and set it up ? This suggests (to me) that the permissions are a bit wonky.........

On the files themselves, aren't there ownership details available ? At the least you should be able to determine WHEN the deed was done.

[edit] Damn !!! but my typing is SLOW. beaten to the punch line by MsM AND Tiger, and this time I was in the ball park. Ah Well, there's always tomorrow.........[/edit]