The issue of the sessionScope object being not reset after Logout has been found and reported in forums. While trying to work around the issue, I tried to call sessionScope.clear() but got an error. From the API, sessionScope is a com.sun.faces.context.SessionMap which has a valid clear method. But the stack trace of the exception shows the clear method of the super class com.sun.faces.context.BaseContextMap is called, which is designed to throw a java.lang.UnsupportedOperationException. I reckon this is a bug.

Finally I used an iteration and the remove method to clear the sessionScope object.