identity impersonation credentials not being passed

I have a computer on my LAN with share that allows access to exactly one user: MyDomain\sam
On my web server I have configured a virtual directory called SECURE that points to the above share.  In the "connect as" dialog I connect as MyDomain\sam
The directory security for the virtual directory is Anonymouns access = disabled, integrated windows authentication = enabled
In web.config I specifiy authentication = windows, identity impersonate=true
Here is the problem ->  When I go to a random computer on my lan and login as MyDomain\hacker and go to http://webserver/SECURE I am granted access.  I can see all the files on the share.  My understanding is that if impersonation is working correctly, I should not be be able to see the files because the credentials of MyDomain\hacker should be passed to the share  (See this: http://msdn.microsoft.com/en-us/library/ff647404.aspx).  It appears that the credentials of the "connec ...