User suddenly logged in as another user
I am sure that there is developer mistake here, we have something like  you guested,a global $user information  overwrite by developer code,I suggest you found when this happened,when a comment submit?when a specified form submit and .... ? 
I think in custom module your developer first  write global $user; and in continue define $user variable,I suggest you search for global $user then look at afterwards codes.