John: The only time I've seen a user login and get another user's inbox is when you have session ID showing in the URL, and that URL has been bookmarked and imaged onto a lab full of computers. Any chance that's your situation?