Our portlets keep state in the HttpSession, which is shared by all request processing threads for the same session. The portlet spec (JSR-168) writes:
PLT.5.2.4.3 Multithreading Issues During Request Handling ...