User created new login - how to find where they got permissions from
As first thing I'd check server level permissions of that login:

exec as login = 'TheLogin';
select * from sys.fn_my_permissions(null, 'server');


As second thing I'd check login's groups/roles, like this:

exec as login = 'TheLogin'; 
select *
from sys.login_token
where principal_id &gt; 0;


And my future actions depend on what I've got for now.
The thing may be tricky: One can have impersonate on sa or be a db_owner of trustworthy's database, so he has "hidden" permissions