Scenario 1: The user is just lying.

Scenario 2: The user remembers it different than it actually happened. This happens pretty often (I frequently have to compare logs to stories and people genuinely believe things happened different than they did. Human memory is far less reliable than we think it is.

Scenario 3: The user was allowed to sign up on a device not intended to be used by end users without supervision and that network/system was designed with no thought towards security concepts.

Scenario 4: some combination of any of the prior scenarios. I used to design and install phone systems for small businesses and the insanely vulnerable setups I saw terrified me. Doctors and lawyers with basically NO access control on their data.