Permission not recognized by collaboration sub-site

Question

I created a sub-site and disinherited from parent. This sub-site contains two specific permission groups. However, people outside the permission groups can still access the site, albeit with read only capability. The site has no anonymous access too. Has anyone encountered this before?

Answer 1

Does either of the permission groups have all authenticated users part of it? Is this using any of the publishing infrastructure? One of the groups (style resource readers) is open to all authenticated users.

Are there any policies in place in Central Admin that would be opening this up to all users?