If they didn't get admin privileges from the admin then they probably just went to cmd and typed in:
at /00:00 /i taskmgr (fill in 00:00 with a time coming up soon)
once taskmgr opened, killed explorer and opened another with system privileges for that machine
I believe White Scorpion was first to point out this privilege escalation method.

As for what to do about it, you could try just talking to the admin, they may not even believe you or they may freak out, but if they didn't give them admin they will definitely want to know about it.