This usually happens when you don't specify a name for the "applicationName" attribute of the Membership provider. This will cause the Membership provider to use the vroot path of your web server.
In the example below you can see the default value of the applicationName attribute, if you don't have it specified:
<membership>
<providers>
<clear/>
<add name="AspNetSqlMembershipProvider"
type="System.Web.Security.SqlMembershipProvider, System.Web, Version=2.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a"
connectionStringName="LocalSqlServer"
enablePasswordRetrieval="false"
enablePasswordReset="true"
requiresQuestionAndAnswer="true"
requiresUniqueEmail="false"
passwordFormat="Hashed"
maxInvalidPasswordAttempts="5"
minRequiredPasswordLength="7"
minRequiredNonalphanumericCharacters="1"
passwordAttemptWindow="10"
passwordStrengthRegularExpression=""
applicationName="/"
/>
</providers>
So, if you for instance move your application from one folder to another, a new application is being created in the membership database.
The way to solve this is to give a name to your "applicationName" attribute.
If you already have membership data you want to use you can name the attribute as one of your existing application names. It is the "ApplicationName" column of the "aspnet_Application" table.
ScottGu had a good post on this here:
Always set the "applicationName" property when configuring ASP.NET 2.0 Membership and other Providers