I don't *think* so - If that were the case, he'd have to log in every session, right?? Every time he shut the browser off, the session would be killed. So when he starts it up again he'd get prompted for his password.
He said 'every couple days', instead of something like "Every time I try to connect", yah?? That has me suspicious, to be honest. Is it possible to do that every user log in, instead of browser session?? I know I don't remember XP working like that. I'm at work ATM, on an XP machine, so I can't check straight off. I'll poke around after I get home, tho...
I'm leaning towards your idea of Browser hijack, to be honest... 'Every Couple Days' doesn't sit right with me. There should be an identifiable system event - Start the Browser, etc...