Maybe check contacts, customers, vendors. They might have been given access that way too.