All of this is dependent on where the site is hosted and if they vendor has access to the file system, database or website admin. If they do, they can do about anything they want. If they don't then as long as your license was generated as a non-expiring license then it's not an issue. You can check this license by going to the License app in v8 or Site Manager>Licenses in v7 or earlier.
I'd check the user database for any sign of those users as well. Make sure they don't have access to the server, website, or file system (ftp, sftp, etc). If you're at all concerned, then you might want to attempt to export your site. If they set the site up properly then you will get almost all of it. If they didn't then you'll be short on some of the items.