By being admin, you can force a vote map, or kick people from server, but he can not change settings if you don't give him webadmin port (he can still try one by one the ports on the IP but he will need time or a program to detect open ports, the log into admin panel to change settings).
And if user is admin and pause is enabled, user will be able to pause the game.