If he had physical access it's very possible he used something like a knoppix disk or NT Offline Password.