What's the uid of the webserver that is serving the CGI? I believe the $ENV{USER} is the user login that owns your webserver process.

PS. On my apache 2.0 server on Windows, this variable is not even set. If you want to display the name of a remote user, you can use $ENV{REMOTE_ADDR} and $ENV{REMOTE_PORT} variables that are set by the web server.