All users that have Oracle have SQL*Plus installed by default. This tool alone would allow any legitimate applications user to attempt to guess database account and password combinations, as would Microsoft Access. Users do not have to be Database Administrators to have these tools available to them.