Access Rules and unauthorized user

When we create an Access Rule, so that a user may only do specific things I allow that person, what happens if that user gives his email address to somebody else who is unauthorized?

How can we prevent the unauthorized person from accessing the correct user’s information?