It's not actually single user mode but autologin, that is why the stolen computer user was still using the same browser and keychain as he didn't have access to admin rights.