Given a scenario where a user unexpectedly has access to a record, which combination of sharing sources (OWD, hierarchy, sharing rules, manual share, Apex share) could explain it?