They might have just been using it in terms of giving it out as theirs for years. Doesn't mean they've ever had access. Or they could have typoed it a long time ago and now actually think that that they've logged in with it when they never have.