You could have your users manually grant API permissions from their PayPal account for your application to make API calls on their behalf.
Once they've done that, you would include the SUBJECT parameter with their PayPal account ID or email address as the value, and you would continue to use your own API USER, PWD, and SIGNATURE. This way the application calls would be made with your account, but any action that occurs would happen on the 3rd party account.
If you want to make this a little easier on your users (and yourself since you won't have to support them so much) you can use the Permissions API. This allows you to setup a way within your application for users to approve your application to make the calls it needs to make, and then you would be working with OAuth tokens instead of their email/account ID.