That is odd and I agree with your assertion, have you connected with Qlik Support regards the issue at all ? check what they have to say.
I assume the user logged out and in again and cleared the browser cache after you made any changes to their profile.
Have you tried with roles only , not directly with username ? do you use AD for your user list and sync with it and set the user as a role member (which is best practice anyway)? It may be that you create this user and you are admin and it inherits admin privs, just guessing here.