I think I am having the same problem with 4.3.5. Here is the scenario:
Create Portal1 with admin user of user1 and password of pass1
Create Portal2 with admin user of user1 and password of pass1
This does not create a new user but simply overwrites the original user1 with the details of the new user one. I believe user1 can now login as admin on both portals. This was a bit confusing to fix the first time, here is what I did.
1. Created new admin user with different username and pass on portal 1 and portal 2.
2. Set the new users to be the site admin on each portal.
3. Deleted user1 from portal1 and verified it was removed from portal2
WARNING! If you delete the user before re-assigning the default site admin on both sites, you will have to remove and recreate the portals still attached to the user.
I need to do more testing, but this appears to happen everytime a new user is created with the same username and password on any portal. If a different password is used, you receive a "user already exists" message.
Can anyone confirm this?