I am baffled.
I set up two sites on my Sharepoint 2003 and gave non inherent rights to user a and b. I created a second site and gave non inherent rights to users a and c.
User b can log onto both sites, where he shouldn't be able to long onto the second site. I've tried to recreate this by copying his account into a new account thinking it was an AD problem. No go, so I thought I'd give my test account admnistrator rights over all of sharepoint and I still couldn't get in.