This is probably more a licensing question than a security one - unless the user in question had no reason what-so-ever to be changing (or creating) "objects" which SAP considers to be developer type activity => which for administrative purposes would require a developer key, but "in the wild" it does not.
More important is the access of the user, and as this is rather tricky to measure over time, it is often usefull to check "who actually did what".
If the user turning up on the list is completely unplausible... then check table TADIR for entries / changes by that user to find the objects. You will often find some "red herrings" (flase alarms)... for example some generated programs, queries...) but it will be a starting point to consider the user's access.
Cheers,
Julius
