Hi Osama,
There could be a couple reasons why this is happening. For one, the user may have used the browser's "remember me" functionality to save the username and password for the login page -- a practice I discourage myself. That would be user by user, and in fact workstation by workstation, though, and not global.
If everyone is getting auto-logged in as the same user, then the logon data may have been saved on the webgui service in SICF (\default_host\sap\bc\gui\sap\its\webgui). Open up the service in tcode SICF and check the Logon Data tab and ensure that user is blank and password "initial."
If that's not it, are you using Single Sign-On in your environment? If so, then it may be picking up your credentials from your network logon.
Regards,
Matt