On some servers, PHP's garbage handling which cleans up session files is disabled by default as they are going the cron job route. If you have access to the servers php.ini file, look for the line that has:
session.gc_probability
This may be commented out, or have a 0 for the value. If it is commented out, uncomment it. You'll also need to make sure it has a positive value, normally 1. At that point the webserver should be restarted as well.
