Frankly, that sounds like the visitor is infected with spyware other such ‘junk’. But if they tell you it only happens on your site, we’ll look deeper.
It’s possible someone put some javascript in a tagboard comment, or at some other place on your site. It could cause an onclick event when they click on a link, which could result in a popup. That’s just one example of how that could be done. I don’t think this is a wordpress specific issue, but it could be the result of a plugin.
Ask them to turn off javascript and see if it still happens. That’s where I would start. And I’d (relucantly) fire up internet explorer and see if I could get to happen to me. And when I say I and me, I mean you, since I really don’t want touch IE. ??