[dba-Tech] Bizarre Web Site Behavior

We just had a user report a very bizarre event. He logged onto our site
using his userID and password, and the data presented to him belonged to
someone else. There's no way that someone could incorrectly type both the
user name and password and guess 100% correct on both counts. I'm no expert
on IIS but I can't see anything wrong with the sproc that manages the login.
Is it possible that IIS confused its sessions? I have no idea where to look
for the resolution to this problem. It should also be pointed out that this
has never happened before (or since).

Arthur