A malicious user might install malware that looks like the standard logon dialog box for the Windows operating system and capture a user's password. The attacker can then log on to the compromised account with whatever level of user rights that the user has. It's best practice in a secure environment to force the use of CTRL+ALT+DEL.