Activity Summary included content of posts to which user no longer had access

Yikes, you are all correct. The access privileges for the category had in fact changed between when the user in question received the email and when I received their report. Nothing to see here AFAICT, and sorry about the noise!