There are two places where timeout is maintained:
1) On the server (managed by the Aware IM server)
2) On the web server (managed by Tomcat)
It is possible that one session times out while the other remains active if your timeout values for both servers are different (there is a special thread somewhere about it). The NMB_OF_SESSIONS function calculates server sessions, not web server sessions, so it is possible that one of your server sessions is still alive. You may want to check your timeout settings to make sure that both timeout values are sync'ed