Sometimes a site shows a message reading: "You are logged in as [user1]. Not [user1]? Please log out."
When is it right to use such a thing? Where are we assuming someone is mistakenly logged in as someone else? I'd like to believe people log out on shared computers, where the shared computers themselves would usually not store cookies etc.
I don't think you're approaching this from the right angle. You've seen a feature, and you're searching for a problem to solve with it. That's backwards; add features to solve problems, not the other way around.
A big red flag is that the only company I see doing this is Amazon. Amazon is a prime example of a company not to copy from. See also 10 reasons not to copy from Amazon. Amazon is huge, Amazon has extremely specific sticking points they've identified from years of use. Amazon also has a lot of non-web design reasons people use the site, so you can't assume their UI should be copied at all.
For the record, this is the only place I see such a pattern used:
On dozens of other pages on Amazon I couldn't find this. It is only placed on the personalized recommendations page for me. It is also in a non-prominent place. All it's really doing is giving a convenient "log out" button in case I get a recommendation page and I get my wife/daughters' etc recommendation page.
This is not a UI element that is on every page. It is not in the header. It is hidden on specific, personal pages for a service that assumes your identity without verifying it; Amazon leaves you "soft" logged in to allow you to view your recommendations/track usage when you're not signed in with a password. In this state if you try to buy anything you'll have to be logged in.
This weird sort-of-logged-in state is specific to Amazon's problems; it keeps you logged in sort of by assuming your identity, but requires real authentication to do things. It is not a common state so it causes some unique usability issues that the large majority of apps do not have. This is why there's many more opportunities to log out in Amazon.
However note that even with this weird state, the "if you aren't X, log out" message is still uncommon. There's no need to assume the user has screwed up unless your data shows that a large percentage of your users are logged in as the wrong user at any given time; and if that's the case you've got serious problems well beyond what this feature would solve.
Once again you should be looking for solutions to problems rather than looking for problems for your solutions. If your site doesn't have a relevant problem, don't even begin to consider adding such a "solution".
For every website that logs in automatically, this can happen. In any household, even in companies, different people share the same PC and the same login in the operating system. This is bad practice, I know, but it's reality.
Users do not understand that by logging in on the OS as user X, they will also be logged in on facebook as user X by default. They just type "facebook.com" on someone else's PC and expect their own page. As soon as they realize it's not their page, they just want to get out of there. for an average user, a cookie is something to stuff into your mouth. Why do you think Google Chrome has an option to create browser profiles?
In other words: it's not intentional.
Showing a link "You are logged in as [user name]. Not [user name]?" is imo a very good way to cope with this situation. It is much more clear than a simple "logout". It makes it more visible that by proceeding you are in fact using someone else's credentials and offers an easy way out of that situation.
When is it right? Never. The answer to your question is contained within it:
"assuming someone is mistakenly logged in as someone else"
Your program can't be smarter than the user. I may have logged in as JNF because she called me and needed me to do something that could only be done on her account and has left her login active at her desk and is being held hostage at a remote location. Sure, this scenario is unlikely, but there are 10'000 others that you haven't thought of and your program can't know, it can only guess.
Better is a message:
You are logged in as JNF, please log out if you are not JNF.
No one gets accused, and more importantly, no one thinks your software is making incorrect assumptions or trying to thwart their legitimate effort to save JNF from her kidnappers.
I would say if there are enough doubts that the current user is the logged in user to necessitate the presence of a link of this sort any user-related information accessible should be of the lowest-security type. I know eBay and amazon both have links like this, however I know that both hide private and or sensitive information from the user (current user) without first entering the password of the assumed logged in user.
If you're using it to show products based on previous searches then fine, if you're assuming a user is the same person and allowing access to private settings you may want to re-consider how the sessions are held. Letting the current user know they're logged in as another user may increase the amount of mis-use when compared to if that user (current) was logged in as another but didn't know. There are a lot of trolls out there!
