revoke()

I don't know, but I'll hazard a guess: the input and output devices of an X session are file descriptors, and have to be handed to and from the display manager and different userspace, and there's nothing preventing one user from keeping a dupped copy of one of the devices.

At least this comment should provoke someone knowledgeable to correct me :)