Simple WSS 3.0 site, running in Windows domain. Several domain users who have NOT been added as sharepoint users at all have access to the entire sharepoint site when they log in to it with their domain credentials. I have no idea why this is happening. Anonymous access is NOT enabled--for either the Web application, the top level site or any of the sub-sites. This is weird. HELP!