For what reason can an opencart user log in under someone else's account?

Question

Redis

Hi toaster.
Has anyone encountered such a problem? The customer, entering the shop member, sees that this is not his account at all. Shop on legacy engine opencart 2.1 centos 6, apache 2.4, php5, sessions - redis 3.9.103, size 700mb and ~50k records, database persist. The radish cannot give other people's session data, and the duplicate session keys are unlikely. But nevertheless, today this happened for the second time, and these are only those who reported to support. Who faced? how did you decide? Any thoughts, if any, even I can not google the problem. Thank you