Have you checked what other groups this user is in?

Note that if a user is a member of another group for which an attribute has a higher level of visibility then that takes priority, and the user will be able to see the attribute.