Do you see unknown usernames associated with a database? Do you have ine-click access to phpmyadmin enabled? If the both are true, then that's the explanation.
The logout will redirect to /phpMyAdmin/direct_login/logout.php, which destroys all SignonSession cookies, so a normal user/pass login can happen if /phpMyAdmin is accessed manually.
...DA goes out of it's way to hide them from counts and listings, even though the are there.
The /usr/local/directadmin/data/admin/phpmyadmin_sso.conf lists all allow users.
The nightly tally will clear any accounts when they expire after 16 hours.
Any da_sso_* user found in mysql that is NOT in the phpmyadmin_sso.conf will be removed for the database.
Any account in phpmyadmin_sso.conf that has a creation time greater than 16 hours, will be removed from both phpmyadmin_sso.conf and the database.