I don't think they can upload without having your username/password. They could upload to other albums, of course...