Sort:  

even if they only have logged in with the private key? and only have access to the private key?

What do you mean with 'private' key. Each key has a private and a public, so they can change the beneficiaries if they have the private active key. Not with the private posting key.

That's what I meant, the posting key. Say I create an account for a friend and then only give them the posting key. They won't be able to remove me as a beneficiary? As I have the active key? Thanks

Yep, correct. Of course this way they will not be able to use their wallet either.