So to the first part about using the Log Off button... are you using Integrated Login for the web? If so, this button will try to log you off then the Integrated login kicks back in and logs you back on. The user will just need to close the page.
To the second part.. have you verified that they do not happen to have a role applied that CAN see that form? Since you can have many roles, is it possible they have one that has those rights? If they do not, I would verify that your Window View Rules are set up correctly for that role.