That's the point: It depends on user Y, how they log in, how the process is run. There is no "Force user Y to abide by some ulimit setting", setting. It is not, and never will be, something handled externally. If User Y doesn't use the normal login process, and isn't forced to run ulimit by any sort of script on login, its ulimit settings won't be changed.

At the very least you might need to restart whatever daemon is launching the process, for ulimit.conf settings to take effect, as this file is read on login, never "forced" onto things just because a file changed. It takes effect when its read -- either login or startup.