[Samba] File got deleted in samba with read only user

[NetOps]

Hi,

I am using samba-3.4.6 file server on centos-5.8 under winbind
authentication with SMBLDAP domain server. Last day I found one of file was
missing from a folder, after checking smbaudit log I came to know that file
got deleted by a user (abc) that don't have read & write permission on that
path. I checked with user (abc) login physically on his system but user
(abc) are unable to modify/delete/create any file at that path. 

As per my past experience I got smbaudit log correct every time but not sure
with this case. 

File was missed, smbaudit logged the event but that user (abc) don't have
write permission on that folder. 

Could you please advise the possible reason for this event?

Thanks and regards,

Shekhar