Either that or the site recycles hashes but does a check against the ip of the client before assignment.
I somehow ended up gaining Pirus session. I logged that out, and logged back in as me. 20 minutes later Piru ends up with my session. If thats just a random one in a billion collision, two times in 20 minutes involving the same two user account, thats highly improbable.