If he done it himself there would be a basket for it in CBSubs > Baskets. If there isn't it was done with an admin operation. Check within CBSubs > History Log as it should log all subscription changes. My best guess is maybe you configure CB Auto Actions to subscribe them to that plan when expired or something of the sort? or maybe one of your sites admins gave the user the subscription?

I don't see how that's possible beyond a direct database insert or the subscription already existing before expiring.

Review the entire payment, basket, and subscription history of the user. You should be able to see where it came from. Within CBSubs > Subscriptions if you click the number under the ID column you can see its raw details like previous expiration date, etc.. to better understand where it came from. This sounds like something deliberately configured though and suggest checking CB Auto Actions actions you've configured as well as your plans CBSubs SQL Actions usages.