It seems that users with access to the staging repositories have permissions to close/drop/promote any staging repo, including those of other users. We should check with sonatype if there is a way to set the security so that users can only modify their own staging repos.