You can impersonate a user with their login data, and given that people frequently re-use passwords, also do this on other sites.