In your global asax file, there is a sub called
Session_OnEnd
This fires when your session actually gets the axe. Try putting in code that will delete the record of the user being logged in (whatever your security scheme might be)
if you're using cookies, obviously the client browser may be closed long before the session dies. In this case, you may need to set some of the cookies properties (like lifetime, etc.) to help accomplish your goals.
hth
D