They might have just been using it in terms of giving it out as theirs for years. Doesn't mean they've ever had access. Or they could have typoed it a long time

They might have just been using it in terms of giving it out as theirs for years. Doesn't mean they've ever had access. Or they could have typoed it a long time ago and now actually think that that they've logged in with it when they never have.