Connections are made using the login's current security context.

So in the following query, the login running the query is the same account in whose context the connection is attempted:

SELECT * from [server\instance2k].dbName.dbo.tblName;

The puzzling thing is that the same user is able to connect to instance server\instance2k through SSMS, while logged on the instance hosting the linked server.