Changed user's password but they're still sending e-mails

A user was let go this morning from employment with us. We immediately changed his password, however, this afternoon he was sending e-mails to people here with his company account. We run Exchange Server 2007 SP3, so he may have been using the webmail from home. Can anyone tell me what happens with the webmail connection when someone's password is changed? Can they continue to work until webmail times out (which apparently takes 8 hours)? Or did something go wrong with our password change? The change was done by someone connecting to the DC and then using an already open ADUC window. The window had been open for several weeks, as it showed some incorrect information on some users. So is it possible that the password change this morning didn't actually take effect? I am having trouble determining what the cause is of this user being able to send e-mail. And my manager is asking if there's any way to see who is on webmail and I know of no way to do that. Is there a way to monitor that and disconnect people?