You're absolutely correct about the Windows ACL system. The discretionary access control system in Windows can easily be subverted by a poorly configured dynamic access control policy.

Windows is not a single-user OS. Even a standard "desktop" installation can support multiple sessions through terminal services, but usually it is not configured to allow multiple concurrent interactive sessions.