I have a scenario I thought was impossible. The login below has an sid that doesnt match the DB user, but is still able to login, access the db and query as normal.
select sid as [sessionID],* from myDatabase.sys.sysusers where name = 'hsi
select sid as [sessionID],* from myDatabase.sys.sysusers where name = 'hsi