An object's organization-wide default setting is set as private, but still, one of your users is able to access the record. As an administrator, your challenge is to find out how the user is granted access.
The following are the steps to debug the problem:
The first step is to check the profile of the user and find out whether the profile has the Modify All or View All settings checked at the global level (administrative privileges) or at the object level. If yes, then this is causing the issue, and it might be worth putting the user under a different profile or creating a new profile and assigning the user to the new one. Also, one has to be judicious enough to conclude whether removing these permissions from the profile will impact other users.
If it is not a profile issue, we need to look at whether the user has a permission set assigned and whether the permission set grants access through the Modify All and View All settings. If yes, then modify the permission...