Comment by wwortiz

It's not actually single user mode but autologin, that is why the stolen computer user was still using the same browser and keychain as he didn't have access to admin rights.