How can I stop someone from changing the admin password on my mac by using fsck?

I recently ran into a forum about changing any users password on any machine (MBP, Mini etc) lion and below, have not tested it on mountain lion. It's basically using fsck > making all files rewritable > then changing the password.

I know it must have been designed for someone to recover a lost password, but how can a business use Macs when a standard user can rewrite themselves as an admin. Hopefully someone out there has an answer.