In the situation you describe, a user with malicious intent (not you of course, but someone else with access to that public computer) will not have access to the previous person's password, and will only be able to use the other person's account until the session has expired (this time limit is determined by the website). However, while they are temporarily logged in to another person's account, they can still do some damage: they are still able to read private emails and send spam or emails with malicious attachments. You can do more damage with banking websites, but these usually have very short sessions and extended security measures, such as forcing you to re-enter your password every 15 minutes.
Sadly, I have found that most people (even sometimes the somewhat computer literate) tend to assume if you close the browser window it "exits" the website you were on, not realizing that you can still remain logged in.
This is not a question about authentication, but one of etiquette.
Are you required to do anything? No. But chances are if you find the user doing this once, chances are he doesn't realize he is doing things incorrectly, and is likely doing it all the time. It would be worth educating the user (perhaps sending him a quick email with an explanation) of the need to click the "log out" button when they are finished checking their email or bank account.
Once they learn that they need to log out when they are finished, it will benefit them in the long run.
Also, as a courtesy, I would log out of his account (perhaps even clearing the cookies of the browser on the public computer so as to log everyone out from all sites visited on that computer). That way, if someone with bad intentions comes along later, at least one person is safe.