I've been having a problem with a user that is using up all his time.
How is time renewed per user? Where is this defined?
It should be renewed whenever they log in for the first time in a day. The time is defined for their security level. If their level is 20 for example, then you would go into the "Security Level Editor" and open up 20, and then set the time per day to whatever you want users of that security level to have.
It could be that there is a bug too; your version is pretty old. There have been other people who reported similar issues (although not lately). The newer versions have some additional logging for whenever "time left" is set by Mystic, but no one has reported an issue lately so I have not been able to capture any logs of the problem (if one exists).
Note that there is a separate timer as well for "login" time. This is the amount of time a user has to login before they run out. Since Mystic doesn't know who the user is when they first connect, it applies this time limit to them until they log in.
--- Mystic BBS v1.12 A39 2018/04/01 (Windows/32)
* Origin: Sector 7 [Mystic BBS WHQ] (21:1/108)