When I updated to Samba 3.0.22 on our FreeBSD server, all of a sudden I found that once I logged into one account (from windows XP) I could browse ANY samba account on the server. I don't know if this is a samba error or if the port had some very bad configurations that it implemented.
I forgot to mention explicetly that I only had to supply a password for my initial log-in, for the rest it did not even ask me for a password.
You don't give a lot of details but I'll guess at what you mean. Make sure to set 'valid users = %S' in [homes] if you want to restrict home directories to their respective user. If this is not what you meant, please mail the samba mailing list since this appears to be a configuration issue and not a source level bug.