It's a very common and weird sight but if users are using different tools to access the db, even after they are killed or after being killed and asked to login to finally complete the killing (since the session was inactive) by executing and allowing it to complete.And then closing the application. Still I've found very weird(I got into an argument with the SA i remember because he thought I was messing around) that the process kept running on the client machine even though the application was closed.
Maybe this will throw in some light and help you further.

Cheers!

Tarry