So I had an issue yesterday where a module was updated on one of my sites that I wasn't ready for it to be updated on. It caused some issues, but I was eventually able to get the previous version back from my test server and it is working normally again.
My guess is that someone with administrative rights (but not User-1) was able to update the module from the web interface. Is there a way to prevent anyone from updating modules except User-1?