Well, for example if the user had too many connections to the server for some reason, or his IP changed during the upload and he got temporarily blocked by your firewall. Or maybe it was clamav blocking. I think those sort of things might cause this issue and be logged.
You can manually run tmpwatch as root user to check exactly what it does with this:
Code:
/usr/sbin/tmpwatch -tv 240 /tmp
The t means test mode, the v is verbose, tells you what it will do.
User account tmp directories are not a part of that. I believe there are other threads on how to automate clearing that with a cron, but I couldn't dig one up here to link you to in the limited amount of time I looked.
Hopefully someone much smarter than I can chime in on this one for you.