In my experience, code reviews are valuable for various reasons, varied purposes, and there is not one best methodology. Reviewing on paper helps reviewers step away from their workstation and focus on the code. Reviewing at their workstation helps them probe the code, build, test, and hit it with whatever hammers they wish. Reviewing in pairs or small groups at workstation (projector in a workroom, whatever) offers a decent mix. Sometimes reviews are remote. Sometimes there's two weeks to review, other times it's two hours.
To your specific question about refactoring, the answer has to be yes and no. The outcome of a review might be that they propose a refactoring (even going so far as to do it for you), but like all changes, they should have a good reason for this. If you don't like what they propose or it's wrong-headed you've got the original. The code under review might just be stylistically imperfect, but it might be narrowly coded (ignoring impacts on other systems or components) or it might be beautiful and work but set bad precedents.
It's comes with the territory that sometimes a suggested change is important and is going to require scrapping part or all of what you've written. Even more important is where lies the responsibility to insist on a change you don't want to make. The reviewer should insist on the change or escalate it to someone who can. The code remedy might be to clean it up a bit for an impending release, but make the next order of business to fix what you've done. It must become a priority and the longer your broken code exists, the larger the damage can be. (Likewise, if they're wrong, you should make the case against the change.)
The form of the changes can vary, but i often find that a list of their concerns with code or test cases where it's helpful is the most useful format.
in user.cs, the delete() method needs a userid parameter
bool delete( string userid ){...}
in user.cs, the add() method is fine but should be reformatted. See our style guide in the dev wiki.
your XML elements and attributes are inconsistent. Please fix these and follow our naming conventions.
log.cs needs to be rewritten and calls to it in all your code will need to change; it ignores failures, doesn't close files, etc. but more importantly, it doesn't use our standard logging components. Look at logging.cs in the blahblah component.