Why are my sales users getting access to accounts they shouldn't?

The reason that these users are getting unexpected access is due to the fact that they have a user in a role below them that is either shared the account or a related record owner. Administrators will want to look at the users associated to the lowest leaf of the user role hierarchy and verify if any of these users are assigned to a territory associated to the account and work their way up the chain.

If their is no visible roles under the user in question the issue is most likely related to portal users. Use the following query to determine which users you need to look at keeping in mind you may need to drill down several roles.

SELECT DeveloperName,Id,Name,ParentRoleId,PortalAccountId,PortalAccountOwnerId,PortalType, FROM UserRole WHERE ParentRoleId = 'Role ID of User with extra access'

Note: The fact that these portal roles role up to this user's role is not visible via UI.