1.8x Why can users login to admin account and different accounts

Hello,

Well what's been happing is that users was logged in there normal account what they have singed up with, then they went to a topic then they went back to index page, they would of been on a staff account or a random, account out of the blue there been no MSQL injections or anything it's a fresh install with a plugin called newpoints and I was wondering what this could be?

Thanks