This was a bypass of our security process, ideally they shouldn't be able to. However, since it wasn't downloaded through the browser, our security solution didn't intercept it. That was a whole other issue, and I was not at all pleased with the vendor. Unfortunately, I can't name-and-shame, but we also switched vendors after that issue.

And due to a legacy system, we can't rely on windows UAC to prevent these attacks either, this user needed to have a local admin account. Yes, this is a security issue in itself, but needs must.