The user and the application do have read-only access to the original documents. The problem seems to have been what the user was able to do outside the application. Clearly, users have more rights to the directory than they need. Unfortunately, I'm not the network administrator. In posting this question, I was hoping to learn exactly what to instruct him to do to prevent this from happening again.

Users have no need to copy documents to a personal directory. We do not want extra copies of the 16 'boilerplate' documents. That's why all the processing is done in memory and under total automation. The only documents users should ever be able to save are the 2 custom ones--the ones they are alowed to modify interactively in Word. Even then, they should be restricted to a single location for saving them. This is something we talked about 2 years ago and the consensus was that it is not possible to restrict where the user may save a document once s/he has interactive control of Word.