How is the vendor connecting to your environment? VPN? Disable the VPN account. Also, analyze your logins and see which ones are used by your app. If possible, change the password on the application account (I hope that account is not SA), and by all means change the SA password. But before you do all that make sure you're not breaching your Software License Agreement by monkeying with all this stuff.