Hi Pete,
Those two users, do they have any other security roles apart from the ones you have created and assigned? If they do, remove them and test again. Check if one user record is set to "Read Only" under user record > Administration > Access Mode.
Also if they have the exact roles and exact user cals, remove IE cache and test.