Comment by smoothgrammer

Try enabling advanced data protection. If they can still log in then you have found a huge vuln.