Oracle 11g user created with Create session but able to update the table?
There is no such thing as a read only privilege. If someone grants update,delete,insert on x to public, everyone who can create a session can modify the contents of that table.

Also, if you create a user x and using a dba account create a table x.y, the user x - who owns the table y - can modify the contents of his/her table, because he/she is the owner of that table.