I thought I had all the right permissions in place, but apparently not: one particular user has edited a certain record, which should not have been possible.
When I look at the sharing of this record (via the sharing button, expand all), the user is not listed there. The default sharing for the object is 'Public read-only'. So the first strange thing is: why aren't all users shown here, since everyone should be able to see the record (and they are).
The only users listed on the sharing page are the owner of the record, the sysadmins and the manager of the owner. They all have full access.
I have checked that other users are not able to edit the record. Where can I find the info that tells me which setting in Salesforce has enabled the user to edit the record?
I have checked the profile, the permission sets, global groups, ... 'Who sees what' continues to be a challenge in Salesforce.