It appears as though the built in admin username and password are cached somehow such that they are the default value for all users - who are able to login with now full admin rights even though they don't actually know the password!
We didn't realize this previously as we only had a single user license being used by one person, but we have now purchased additional licenses and are rolling it out - and found that all users could log on as admin and it was the default.
Urgent assistance required!
Val