When did do a search? After recent role changes in Prod? The user could be assigned the old profiles and still have the old authorization although the role and newly generated profile do not contain this transaction. Try to run PFUD on the roles or wait until the next execution. (When we are talking about composite role changes on the contained single roles this is also required)
AGR_1251 lists the configuration of the role. I would take every role of the user, derive the dedicated single roles and list every S_TCODE object in it. This filter should be sufficient if you have doubt with SUIM. (however SUIM should work)