How comes that login with no rights cam give himself db_creator?
Is the other person a local admin on the server? You need to look at the simplest explanation, which is he either knows the SA password, or he reset the password to the SA account, which a local admin at the server level can do. 

Dbatools even has a cmdlet for it. If neither of those things is true, then he knows your password. If you keep your passwords on the same instance in a  "password table" encrypted with the default encryption it is relatively easy to retrieve the clear text using any one of the 100s of programs that can do it. Apex makes one that you can download for free.

The simplest explanation isn't you have a magical SQL server that lets users with no rights grant themselves high-level rights. The simpler explanation is he figured out your password or the SA password somehow.