Have you got any other authentication methods enabled under Site administration → Plugins → Authentication → Manage authentication, other than:
I'm just wondering if the user with empty firstname, lastname and email fields could be being authenticated by another source that doesn't have these fields populated?
You say that when the user's firstname, lastname and email in their profile are updated this information isn't saved. Does it appear for that user until they log out, does the firstname and lastname you enter appear in their profile menu that appears in the top right containing the Log out menu item?