I think I have found a hole in the media library permissions. Please see my topic at this link. Media upload permissions issue. Basically a user can edit media that they are not the author of if they go to the post edit screen click the link to upload a file and then go to the media library tab. I have a snippet of code that has fixed this for me.