Users have an extra authorisation and they can do things that they are not supposed to do.
Please check the follow things:
1) Check the user roles / profiles under transaction SU01. (Especially SAP_ALL profiles)
2) In ActiveControl check the delegations. You can find it under Tools/Force delegations and Tools/Delegate Approvals
3) Are the users assigned as a Tester on the Business Task? (either as ALL SYSTEM or against the individual System/Role where the testing sign off is being done).
4) Is there any user assignments on the Business Task?
5) Are the users marked as Administrators or Priority Approves? (You can check this under Tools/Configurations)
6) Are the user roles correct in ActiveControl? (You can check this under Tools/Configurations)
7) Are the Inbox Approvers and Outbox Approvers correct in ActiveControl? (You can check this under Target Properties)