tablespace is tricky. Are you sure you dont mean 'schema'?
There is a bug in 9iR1 which means you can do an ansi join to any table in any schema
It's been fixed for R2. Ok back to the question. A table can have grants to another user, or role, and a user can have roles. And a role can be given other roles.
If you have OEM installed have a poke around under 'Security'. Sorry I have no idea what an SQL query would look like, far to many combinations to cover.