Except it sounds like the spyware is still installed even if they log in with their personal account? The isolation principle is violated. It's a huge security hole.