Sort:  

Yes, it's always up to the owner of the account.

even if they only have logged in with the private key? and only have access to the private key?

What do you mean with 'private' key. Each key has a private and a public, so they can change the beneficiaries if they have the private active key. Not with the private posting key.

That's what I meant, the posting key. Say I create an account for a friend and then only give them the posting key. They won't be able to remove me as a beneficiary? As I have the active key? Thanks

Yep, correct. Of course this way they will not be able to use their wallet either.