Will be interesting to see what the problem is here. From what I have seen in real life my top guesses are. Some dependency on static variables in code. Reversed proxy with incorrect cache rules that ignores headers or some parameter.
Store user in static variable during processing data, then forget to clear the variable when you are done, so for the next request it still has access to the old data?