This is why you should not authorize others on your account. Remove all authorized users and then your account is secure. You authorized everyone, so they could approve him resetting your passcode.
Not secure.
Its like handing out house keys. Before you know it everyone has one.
I am the only one authorized on my account and I change the passcode each time it's used in stores. Changed it 4 or 5 times last year.