Running spybot innoculate feature and accepting all defaults without
reading or understanding what is being done is the most likely cause.
Poster doesn't understand relationship between spybot innoculation and
IE restrictions, so doesn't mention using spybot.
A casual reading of the spybot settings would indicate that Internet
Options can be blocked entirely from within IE (HKCU), but should be
accessible via Run or control panel menu. There is no mention of
blocking the advanced tab. Of course, this particular situation might be
caused by some other spyware blocker/innoculator.
Of course, if the user is in a domain with group policy, that is another
explanation.