Could it be an automatic process, kicked off by cron or some such, running as root, and not specifying the db or user, therefore defaulting to root & root?
--
Scott Ribe
scott_ribe(at)elevated-dev(dot)com
http://www.elevated-dev.com/
(303) 722-0567 voice