Hello,
Did you checked whether the same transaction code is available in any other roles which is assigned to him/her.
1.There might be a possibility user is getting access for same transaction code from different valid Role.
2. Check any standard profile assigned to that user
Regards
Kiran.S