non step-editor able to edit record at end step

We have a subcontractor business process.   The contractor declares his subcontractors for our approval.   The end step is an Action form, which can be edited by our staff person, listed as a step editor.   We have discovered that the contractor can also edit the end step, even though they are not listed as step editors.  Any idea why?  And how do we stop this?