Jenn,

I imagine that there is some unexpected rights that your user has that you
have not found.  By now, you have probably already done:

use yourdatabase
exec sp_helplogins 'loginname'  -- login overall rights
exec sp_helpuser 'username'     -- user role membership
exec sp_helprotect @username='username' -- directly assigned rights

Be sure to repeat the sp_helprotect for each role that has the user as a
member.

Slightly more mysterious:

I understand that this is a Windows login you are testing.  Do you tend to
grant rights to Windows Groups (as I do) rather than Windows Logins? If so,
then another thing to check is "What Windows Groups with access to my server
have this login as a member?"  Then, "What rights are granted to those
groups?"   This is a little more subtle if you don't have access to domain
tools, but you can do the following from SQL Server running as the
'loginname' that you are having trouble with.

select name from master.dbo.syslogins where is_member(name) = 1

This will return all logins with the current login as a member.  If this
exposes a security context that you did not know about, then you can pursue
what rights that group has.

FWIW,
RLF

If you say "SELECT USER" what does it say? The name of this user or
does it by chance say "dbo"? In the latter case your login somehow
is a sysadmin member and is of course able to do anything.