The DMS Authorisation list has nothing to do with CALs. You could have far more DMS entries than CALs and it would just mean that the later users just couldn't get in, it wouldn't remove them. From memory the DMS list is stored in the .meta file alongside the .QVW file in UserDocs. Is it possible the file is getting corrupted some how?
It would also be helpful to know if you have Publisher or not and what Service Release of QV10. Plan to upgrade to the latest SR if you've not done so already.