The 'Preferences' dialog changes settings in the database ACL - so to see exactly what access a user has, you'll need to check the ACL...

From your mail File - click 'File -> Application -> Access Control'. Then click the user's name in question. To the right, their actual authority is listed. As I recall, if you've delegated access to Calendar & ToDo, then the user should have 'No Access', and checkmarks in the following boxes:

'Read public documents'

'Write public documents'   (only if they were given access to update or create Calendar or todo)

'Replicate or copy documents'

If they can read mail, then I'm assuming they have 'Reader' access or above, instead of No Access.