Bing bot following user on password protected pages?

Maybe that user has a toolbar from Bing installed. This toolbar might submit visited URLs to Bing, and the Bingbot might (try to) crawl these URLs then.

From the searchengineland.com article How The Bing Toolbar May Accidentally Submit Private Pages & Ads:

Microsoft has confirmed that they do discover and index URLs that they find through users surfing the Internet with the Bing Toolbar installed.

[…]

Duane Forrester, a Senior Product Manager at Microsoft, told us:

Yes, as with some other toolbars, the Bing toolbar (when permitted by the user) may record the open (not https) web sites that a user visited to add to our knowledge of the internet in order to improve the search results we provide to users. This in turn (if the site permits) may indeed lead to our crawling links we have discovered. […]

(The article is from 2012. I don’t know if things have changed since then.)