Is this a terrible security breach?

Question

I have two admin accounts on my MacBook Pro running 10.5.7. I am logged into one of them. Activate the screensaver. To wake up from screensaver I've set it up to require the password. So the password prompt comes up. It's already got my account name filled in, and is waiting for my password.
Now, I pretend I don't remember my password for the account that's already logged in. So I go into the already filled out field for account name, I type over it my other admin account name, then enter that second account's password in. I am expecting to be logged in as the second admin user, right?
Wrong! The screen flips, and I see where admin account 1 left off!
Surely this is not supposed to happen?

Answer 1

If the behaviour of the screensaver password box bothers you, it is configurable via the "/private/etc/authorizations" file.
However, you appear to have a misconception of what an "admin" is in "OS X", and what they can do. An administrator can certainly administer the system, but another aspect of their function is to administer other users. Creating accounts for new users, deleting them when they are no longer necessary, cleaning up their files, etc. They can also do things like turn on screen sharing to access the user's desktop view remotely, which can be useful in a "help desk" context, but also to eg. make sure students are doing their work instead of something else, i.e. to snoop.
Make no mistake - an "admin" has full access to any logged in session, and any unencrypted file on the system so there is no security risk in allowing them to unlock the screen.
It is important for Mac owners to recognize this, so that they only give admin rights to trusted individuals, don't leave their own "admin" sessions unattended, and for that matter, only log in to an "admin" account when necessary to perfor administrative tasks.