If you suspect parameter sniffing, add OPTION (RECOMPILE) to the end of the query. That causes the query to be "recompiled" every time it executes. I don't recommend that you leave it that way, but if the extreme variation in performance goes away when you add OPTION (RECOMPILE), that would tend to confirm that the problem is parameter sniffing.

Also, if you execute the same query with different ANSI SET options active, then SQL retains a separate query plan for each distinct set of ANSI options. This is a common source of problems where "It runs fast in SSMS, but slow in the application".

In fact, given the behavior you have described, I think it likely that something of this sort is happening. You are running your test queries in SSMS, but the user with the problems is using an ADO.NET or ASP.NET application, which has different default ANSI options.