I think the data resides in the Application Scope.
After reloading the page for user B, what is the data for user A I think you will data of userB then .
This is an issue of session management, you have to see how portlet sessions are managed.
It's really hard to know; it could be a caching issue; a session management issue (i.e., sessions aren't getting destroyed when users log out); or an issue with the code in the application itself. Can you post any more details about your application?