Do you have the same problem with a version of JBoss that is not 5 years old?
Anyway, since you are pooling by security-domain (user/password) and application (e.g. queue/topic connection)
you will have seperate subpools for each with 20 connections available for each subpool.
e.g. 20 different users would produce 20 subpools = 400 available connections
A more modern version of JBoss would let you see these subpools and their stats on the JMX console.