Hi @aas,
This sounds like either a cookie-related issue, or something to do with one-click review URLs.
Try disabling session_check_ip in config.inc.php to see if it’s possible that his IP address is varying, causing the session to be invalidated.
For one-click review URLs, I would suggest upgrading to the latest OJS 2.4.x release – OJS 2.4.6 is an older release and it’s possible that there was an issue that is already corrected.
Regards,
Alec Smecher
Public Knowledge Project Team