i'm thinking that your user is in a windows group that grants them permissions you didn't expect.

this query seems to get all the individual mappings for all the groups i have added on my server;

from there, i can query it and find myself, and what groups i belong to:

IF OBJECT_ID('tempdb.dbo.#tmp') IS NOT NULL

DROP TABLE #tmp

CREATE TABLE [dbo].[#TMP] (

[ACCOUNT NAME] NVARCHAR(256) NULL ,

[TYPE] VARCHAR(8) NULL ,

[PRIVILEGE] VARCHAR(8) NULL ,

[MAPPED LOGIN NAME] NVARCHAR(256) NULL ,

[PERMISSION PATH] NVARCHAR(256) NULL )

DECLARE @groupname NVARCHAR(256)

DECLARE c1 CURSOR FOR SELECT name FROM master.sys.server_principals WHERE type_desc = 'WINDOWS_GROUP' AND CHARINDEX('$',name) = 0

OPEN c1

FETCH NEXT FROM c1 INTO @groupname

WHILE @@FETCH_STATUS <> -1

BEGIN

INSERT INTO #tmp([ACCOUNT NAME],[TYPE],[PRIVILEGE],[MAPPED LOGIN NAME],[PERMISSION PATH])

EXEC master..xp_logininfo @acctname = @groupname,@option = 'members' -- show group members

FETCH NEXT FROM c1 INTO @groupname

END

CLOSE c1

DEALLOCATE c1

SELECT * FROM [#TMP]

--WHERE [MAPPED LOGIN NAME] = 'mydomain\Lowell'