User with no access can move around in the database

Maybe Im missing something. One of our users asked me to copy her access for a new employee.  When I went to her role to see what her access is, nothing is checked off.  She has no role.  Checked the access logs and she logged in today.  I asked her what she is able to do in the system and she said she has been pulling EBO reports and making appts, accessing patients and working in the HUB.  She doesn’t log in very often.  I asked her to log out and back in thinking maybe someone just removed her access while she was logged in.  But she was still able to work with no access.  I placed a ticket and eCW asked to call me back and I guess are still trying to figure it out.  Any thoughts anyone?
Karen