Is that possible that a developer have access to my droplet directly without being added as a member by me on my DO Management console

Is that possible that a developer have access to my droplet directly without being added as a member by me on my DO Management console ??

I actually trusting the developer enough to give him the username and password of my DigitalOcean management account, which has triggered the two factor authentication token number . I gave him that token and he gained a complete access to my DigitalOcean management console.

By doing that I assumed that the developer went and created a user account but surprisingly I discovered that he didn’t add himself as a member on my Digital Ocean management account.

Now this is the VERY Important Question:-

1. How did he do that and how can I stop him from accessing the droplet ?