Is this session coming to the database through a job? I have noticed that sometimes when this happened to me, it turned out to be the j001 process. Check the OS process by joining v$session to v$process view.