It probably has access through the BUILTIN\Administrators group that is under Site Setttings\Security by default.

You can remove or reduce the permissions this account has to prevent this from happening BUT you must be sure that you have specific access to SSRS outside of this group otherwise you will find you can't re-connect, also need to check if anyone who is part of the local administrators who needs access has been specifically been granted rights to SSRS outside of this group.