Did you actually see them do it?

They are likely to be just using a boot disk and resetting the admin password. Then logging into admin and creating an account.