Where's the log for when this happens?  As MAC auth wouldn't go through EAP tunnel it would suggest that some entry in eg users file is coming into play...

alan