Correct.


And all the molecules of air can collect in the corner of the room causing everyone in the room to suffocate, but the probability is so low that we consider it impossible.


If the users are using faulty software that does not properly generate a random number (so that multiple users end up generating the same number), then all users that generate the same number will have the ability to spend the bitcoins that are sent to the address.  Whoever spends an output and gets confirmed first gets to be the "real" transaction for that output, and any transaction created by any of the others to spend the same output are rejected.