Commit from unauthorized collaborator

I have a private repository. I have two collaborators added to the repository.
Few days ago, I noticed that another collaborator (who has relation to one of the added collaborators added) committed new branch into the repository without being authorized to do so.
How is that possible?

The author and committer are recorded in the commit itself, and are not related to who is allowed to push to a repository. Maybe you or one of the other collaborators pushed a commit by someone else?

It is definitely not me.
I’ve reached out to the other two collaborators asking if they are aware of that. Awaiting their responses.
It make sense though, what you suggest.