There's two solutions. You should probably do both of them.
First, when user2 is logged out, it should probably be removed from
the store. Things are removed from the store when there are no longer
any event bindings. If the user is logged out, what is still binding
on this user? It's possible there's a memory leak.
Second, When a different user logs in, it's ID should not match
the previously logged in user's ID. If users don't have an
`id` property, they probably have a unique `email` property. Set
Model's static `id` property to a unique property.