We have a new managed user on our account, they are from our company, but none of the admins or co-admins added them. Everything I've found says only an admin or co-admin can add managed users.

This could becaome a big problem if it continues to happen as we'll be expected to pay for seats that we didn't authorize. Any idea how this could happen?