As for the capturing a different pokemon while supposedly not using other tabs / browsers or something, I still don't really get how it could be possible, and I've never experienced it. If sessions were broken, you wouldn't be able to stay logged in.
Either way, after the next update, your encounter will be stored in a specific key under the session var tied to your account, rather than the generic php $_SESSION superglobal. The only possible source of a pokemon to run the capture on is yourself.