WinSCP reads settings from HKCU hive of the Registry. Each user has its own copy of that hive. It's not shared anyhow. WinSCP settings/sites cannot appear there magically. Someone had to put them there.
There's something missing in your description.
For the old users, when you/they start WinSCP, what configuration storage do you see in the preferences? And what do you see for the new user?
I found the problem. This user was the only one using the Windows Registry option for config. storage. The rest are using the custom configuration and are sharing the same .ini file.
Thank you very much for your persistence!