I believe there are different ways items like this can get into the system. From the notes here I am not really sure on the method your user follows. If you are using the PO module there is a separate permission window available in that module, and I would start there. Otherwise more information on the process may be needed to get into speciifics.

Alternatively I think this is something support would be able to help out with if you gave them a call.