Module removed in the root folder's web.config is being used in a subfolder

Module removed in the root folder's web.config is being used in a subfolder

My application has this structure
MyApplication -Themes
In my application's webconfig I remove the UrlAuthorization module and add
my own:
<modules runAllManagedModulesForAllRequests="true">
<remove name="UrlAuthorization" />
<add name="MyModule" type="MyType, MyNamespace"
preCondition="managedHandler" />
</modules>
My Theme folder has this webconfig (this is the complete webconfig):
<?xml version="1.0"?>
<configuration>
<system.web>
<pages styleSheetTheme="" validateRequest="false" />
</system.web>
</configuration>
I have this deployed in 3 environments. 2 of them works correctly but in
one of them I have the UrlAuthorization module working when I make a
request do a file inside the Theme folder.
I know that the UrlAuthorization is active because I do not get the
resource I requested, but an URL /ReturnURl/... path
The < remove> tag is working because removing it causes the whole request
to be redirect to the /ReturnUrl
Is there any reason that may cause this behavior to happen only in this
machine? I deployed all of them and I do not remember making and different
task on any of them
thanks!