The /usr/bin/shutdown has a BIG BUG anyone can shutdown a the computer using his OWN password!!! this can be disabled by removing all the filepermissions for other users on the file /usr/local/consolehelper but this is NOT a bugfix, it is only temporarily!!!
*** This bug has been marked as a duplicate of 2606 ***