Report: "If my secretary logs with our account, it works. If I do, the website logs in but then later shows me errors message when I try to submit a report".[0] Entirely repeatable. Screenshots sent showing it exactly. All of us scratching our heads. How could our web server know who was sitting in front of the keyboard?

Root cause: the username was a number with a leading zero. The login didn't care if you used zeros or not, but the internal logic did care. She logged in with them, he logged in without them (or was it the other way around?). Once logged in, the username was taken from a cookie or something that had been set at login time and fed into the internal logic, which barfed.

Lessons learned: either don't have forgiving logins, or have forgiving functionality when users use inconsistent logins.

[0]They were indeed sharing an account with the same username and password. It was 2005 and government website, so this made sense.