I just got an email from Twitter explaining that there was a bug in the password reset system, causing active sessions to stay active after a password reset.