Alternatively, maybe the user has another P_PERNR authorization for IT 0316 where PSIGN is "*" (overriding the one where it's "E").
You may also want to check the AUTHC field of that P_PERNR authorization. The authorization for approving is "E" and not "W" if I'm not mistaken.
Good luck,
Brent