Exactly what I was thinking. As my next step would be to deactivate other sessions. Then bam, no more access for this other person....