If swisscart®/osCommerce is configured to store sessions in database then
sessions table have to be purged from time to time. Here is the small script that does it:
$lnk = mysql_connect(DB_SERVER, DB_SERVER_USERNAME, DB_SERVER_PASSWORD);
$query = 'DELETE FROM sessions WHERE expiry < "'.time().'"';
It have to be dropped somewhere on the server and triggered as a cron-job.