User can see accounts they should not ?

Try checking User and Group Sharing on the Account record:  https://YOUR-DOMAIN-NAME.my.salesforce.com/p/share/AccSharingDetail?parentId=xxxxxxxxxxxxxxx

*Replace the x's with the Account record ID

Look at the "Type" field (second column) in the results, then see if the User is a member of one of the Public Groups that has Read + Edit access to the record.