This may be the case that the original user's session continues to live in the server and the original session key continues to be acceptable (even if it is not readily available in a cookie). Some minor security risks involving leaving the server-side of sessions hanging around include increasing the time window where a session hijacking is possible and not releasing unused server-side resources. As I said, these are pretty minor and are dealt with every time a user wanders away from the site without first logging out.
Note that the site may actually be logging out the first session on the server side before executing the second authentication. To determine what is actually happening, you would need to have access to server-side code or run a test where you capture the session ID before reauthentication, reauthenticate, and then try to reconnect with the initial session ID.