This is SP 2010. I have a personal site (i.e. my personal site with My Host Site), and in that site I have created a Team site. In that team site, I have removed all permissions except for myself (full control), SHAREPOINT\system (limited access), and a "Team Contributors" group I created. That group contains only individuals, no SP or AD groups. Inheritance has been turned off for the team site.
When a member of my "Team Contributors" group shows up to the site, they have the desired Contribute permission. But, when a non-member visits the site, they still get in, albeit with "Read" access.
For me, the kicker is, if I use "Check Permissions" for that very same not-"Team Contributor" user, or other similar users, the response is "None". So how are they getting in with Read access?