Why does user have access to this field?

How can you find out which permission set or profile gives particular field access ?  Yes there is a way. You can use fieldpermissions object to retrieve this information.

Here is one sample query -

SELECT Id, ParentId, SobjectType, Field, PermissionsEdit, PermissionsRead, SystemModstamp from fieldpermissions where SobjectType = 'Opportunity' and field='stagename' and  parentid in (
SELECT PermissionSetId from permissionsetassignment where assigneeid = '00532000006644')

Here parentid is profile or perm set id.