Hmm, maybe it's just the System and root Library folders that require authentication. But those would be what you'd need to access to install a keylogger or some such monitoring software, I'd guess.