This is how it works.
Inheritance:
Site A - User 1,2,3
Site AA - Reference to security of A
Site AAA - Reference to security of AA
If now, in site AA you decide to break inheritance you will have
Site A - User 1,2,3
Site AA - User 1,2,3
Site AAA - Reference to security of AA
(user 1,2,3 already have acces to Site AA so they are stored on the level of Site AA now)
So if you add a user 4 to Site AA the situation will be
Site A - User 1,2,3
Site AA - User 1,2,3,4
Site AAA - Reference to security of AA
and user 4 will appear both in AA and AAA
now, if you expand this with two more sites, one with and one without inheritance
Site A - User 1,2,3
Site AA - User 1,2,3,4
Site AAA - Reference to security of AA
Site AAAA - User 4,5,6,7
Site BBBB - Reference to security AAA
if you then put Site AA back at Inheritance, you will get
Site A - User 1,2,3
Site AA - Reference to security of A
Site AAA - Reference to security of AA
Site AAAA - User 4,5,6,7
Site BBBB - Reference to security AAA
In that case, for subsite BBBB the rights will change from 1,2,3,4 to 1,2,3
For subsite AAAA nothing will change, as it broke it's inheritance with its parent
I hope this makes everything clear. Personally, I advise not to use breaking inheritance too often as you can image adding one user to all those sites that have broken inheritance is a PITA.
It is not normal that the security changes overnight unless you recovered from a backup (or someone changed it back)