PS...I think I see what happened. The self-enrolment plugin is installed, and although the settings say that self-enrolment isn't enabled by default, the self-enrolment plugin itself wasn't disabled, and possibly it enabled itself for the given course somehow even though it said it wasn't enabled by default. So as soon as a user's access expires, that user can simply click a button to re-enrol. So the solution to disable the self-enrolment plugin.