I have a very simple "logout" function, built in the "Seam-way" I believe:
link to logout:
<s:link action="#{loginClient.logout}" view="/Login.seam" value="Logout"/>
 public String logout()
 {
 Authenticator.instance().unauthenticateSession();
 Seam.invalidateSession();
 return null;
 }
Did you check to see if the information is stored in a cookie? Does the information still get populated from a new/different browser? I can't answer your question, but maybe this will help you find the answer.