They probably had permissions to change/reset the access credentials which can be used to gain access as a the user.