From what I read, it appears pretty straight forward. You insert kon-boot and have the machine boot into it. It mounts the OS on the drive and since you are already running as root on the disk, they can edit the machine however they see fit since it is now the ultimate authority on the computer. An easy way to stop this would be to lock down the boot order so that only admins can edit it.