Too much access...
db_ViewProcedures, that doesn't sound like a normal role ;)
I would have said that the problem is that they have db_denydatareader and db_denydatawriter, however I would have thought db_owner would have overridden that. My understanding is that DENY always overrides GRANT except in the case of sysadmin or db_owner. I could be wrong about db_owner though.
Nice post very helpfuldbakings