i-Notes uploaded id file and internet password question - HELP!

I have a user who uploaded his notes id into his i-Notes mail file. He then changed his password on his id file. He can now log into i-Notes using either his internet password OR his new id file password.

Is it supposed to work this way? I would think it is a security issue…