A login is a member of db_datareader and public roles only, but it is not read-only
I was looking through all items in Security nodes in SSMS and it seems that somehow the properties of the public database role have been changed. They looked like this:



I don't really know how they should look like normally, but clearing the Delete, Insert, Update checkboxes seems to do the trick.

The immediate problem is solved now and I'll have to read more about the public role and what settings it should have.