The mystery is why user was connected to a fake pool after being disconnected from legitimate pool.
This is probably some kind of MITM attack as the user was connected to a fake pool after disconnection. The question is where this MITM attack was performed.
Thanks Terk for all your help thus far!
Just to clarify, what sort of MITM attack are you thinking of? It would essentially have to be router based, no?