> But in this case, how to determine it's really the user? Should "Bob" identifies himself by disclosing his password, and have the admin test of the login work

> But in this case, how to determine it's really the user? Should "Bob" identifies himself by disclosing his password, and have the admin test of the login works?! That's one way to do it. Another way would be to ask them to log in and set some preference (change their info field or name to "DELETE ME") or something like that.