Someone pointed out a major security breach on here the other day that involved using an old session ID to log in to an account and completely bypass the entire authentication system. That might be what is happening to you.