Your code within try is
try
{
ToUsers = (List<user>)Ser.Deserialize(ToStream);
ToUsers.Add(lastuser);
Ser.Serialize(ToStream, ToUsers);
}
what is happening in the above code is, during de-serialization, the stream position pointer is moved to the end of the file. So when you serialize back, the list containing the two objects is appended at the end of the file.
Hence, the new file structure is like
+---------------------+-----------------------------------------------------+
| List (1 user info) | List (2 user's info) |
+---------------------+-----------------------------------------------------+
So, when you de-serialize the next time, you again get the list containing one user's details.
To overwrite the existing data, reset the stream position pointer to the beginning of the file using
ToStream.Seek(0, SeekOrigin.Begin);
Hence, your try block would look like
try
{
ToUsers = (List<user>)Ser.Deserialize(ToStream);
ToStream.Seek(0, SeekOrigin.Begin);
ToUsers.Add(lastuser);
Ser.Serialize(ToStream, ToUsers);
}