LSO: System user is booking courses for different user with the same ID object

Hi Experts,

I have a problem with the LSO, one unathorized system user is creating booking for other users without authorizations, this increasing the HRP1001 of our SAP ECC RH. One object is affecting this

This is happenning with the ET -E-leaning events. When we asking for the user, they told us that only navigate in the course.

INFTY 1001

subtype A614