Finding AD group permissions source
Login as the mystery user. Then run:

select * from sys.login_token


Somewhere in the output list will be token that grants you access. For instance you can try this (not guaranteed to work):

select * 
from sys.login_token lt
join sys.server_principals sp on sp.sid = lt.sid;