How do I find out *why* a user has certain effective permissions?
You can find some good information regarding security from the article below.  

Reviewing SQL Server Permissions | TechRepublic http://tek.io/KfzEyp

Except: 


  The following query uses the sys.database_permissions system view to
  indicate which users had specific permissions inside the current
  database.


SELECT
        dp.class_desc
       ,dp.permission_name
       ,dp.state_desc
       ,ObjectName = OBJECT_NAME(major_id)
       ,GranteeName = grantee.name
       ,GrantorName = grantor.name
    FROM
        sys.database_permissions dp
        JOIN sys.database_principals grantee
        ON dp.grantee_principal_id = grantee.principal_id
        JOIN sys.database_principals grantor
        ON dp.grantor_principal_id = grantor.principal_id