Question: I have a select element with 20+ options and size 10. I do not have the multiple attribute on the select. However a tester is able to select multiple options. The tester is using IE7 on Win XP.

How is this possible? 

Could the tester have a client override to enable this? 

**Update:**
In response to most of the comments.

* The select element isnt posted back its just used in some UI and javascript.
* The tester isnt doing anything out of the ordinary (firebug, headers)
* the html is your standard select element with a size attribute of 10 on it.

Answer: 
The client can override anything they want - by sending them the HTML to render the form, you are guaranteeing nothing about what will be sent back.

You should be parsing the information being sent back and checking for validity - if you expect only one value for that form input element, either error or drop the additional values.
**You need to check everything on the server**

Simple! You can't trust anything coming from the browser. If you expected one item to be selected, then check it on the server and display a message if not.

You're tester has uncovered a fundamental security issue with your site and I'd thank them for this.