A normal user can obtain space admin level by manually editing/creating WebPreferences in the object editor or programatically

A normal user with only edit rights on a wiki can access or create a WebPreferences page for a space and an an XWikiRights object, thus becoming a space admin.

For the current space, methods like:

• api.XWiki.hasAccessLevel("admin")
• $hasAdmin from xwikivars.vm that uses the above
• XWikiRightService.hasAccessLevel("admin", user, docname, context), where docname == currentModifiedSpace.PageName
• api.Api.hasAdminRights() with all its subclasses
• XWikiRightService.hasAdminRights() for any plugin/service that is using it being called from the current space
  will all return true.

An example usecase where this might cause problems is the method api.XWiki.setReadOnly(true) which will set the entire wiki in read only mode.