To enable or disable it, the login needs to have the sysadmin or server admin role or have been granted ALTER SETTINGS. I really hope you don't have so many of these people that it's hard to find. Also, with this level of permission, they should be able to be honest when asked.