Interesting scenario, on the surface it sounds like the Sharepoint site  is
accessable by everyone within your organization. You can restrict access  to
a specific area/subsite/workdspace/folder/list within SharePoint by going to
the specific part of your site and changing that portions 'Modify settings'
and 'Change permissions'. What you are likely to see is that the permissions
are set to allow the roles of Reader, Contributor and Web Designer to
perform actions on that section. To demonstrate restricting permissions
create a new list , then go to that list and add  your domain account and
give yourself Reader only role. Remove the three roles that area already
there (you will need Site Admin privs to do this).

Now go to a coworkers browser who is already logged on to their PC and
browse to that specific list, that user  should no longer be able to view
that area (you may have to refresh the web browser).

This demonstrates how granular SharePoint security  is, there is often a
critique that SharePoint can't secure individual items like documents, the
workaround is to create a folder and place  the document folder.

As for your situation this is probably not teh answer as you provbably don't
want to have to secure individual lists.. it sounds to me like the Site
Settings/Permissions/Roles are set either to Anonymous or the IIS settings
are set to allow access to a wider audience than you want.