Why does this minimal ISAPI extension fail when there are simultaneous multiple users?

Question

This ISAPI extension simply sends back whatever string it receives:

Function HttpExtensionProc(var pECB: EXTENSION_CONTROL_BLOCK): DWORD; export; stdcall;
var html: string; size: DWORD;
begin
html := 'Content-Type: text/html' + #13#10 + #13#10;
size := length(html);
pECB.ServerSupportFunction(pECB.ConnID, HSE_REQ_SEND_RESPONSE_HEADER, '200 OK', @size, pointer(html));
html := pECB.lpszQueryString; // send back what was received
size := length(html);
pECB.WriteClient(pECB.ConnID, pointer(html), size, HSE_IO_SYNC);
result := HSE_STATUS_SUCCESS;
end;

A separate test program is used to send an infinite loop of random numbers to the IIS server, and confirms the number returned by the ISAPI extension is the same.

A single instance of the test program ​exchanging requests and results runs forever without complaint.

But soon after another instance of the same test program is simultaneously used to send random numbers, both programs frequently receive the wrong number, as though there is a timing or reentrancy issue.

When I add EnterCriticalSection() and LeaveCriticalSection() calls where HttpExtensionProc() starts and finishes, everything works fine and multiple users of the extension never fail to get correct results. The ISAPI code doesn't use any globals or static variables, so reentrancy should not be an issue.

Why is a mutex necessary?