You say there is "no way", but knowing or guessing both your ID and password is the only way for someone to add themselves to your account. Being in IT gives that person no special way to get into your account other than, again, knowing or guessing your credentials.
Who else has access to this written information? Whoever that is passed on your ID and password.
Regardless, go here:
https://appleid.apple.com/
Login to your account. In this order:
- Click on Sign-In and Security in the left column. Under Notification Email, remove any you don't recognize. You don't want them getting notices of what you'll do next.
- Under Account Security, check the trusted emails and phone numbers. Remove any you don't recognize. Again, to prevent any notices going to unknown persons. Make sure to change your Two-factor ID questions and answers. The best way to use these is nonsense answers. Such as, if the question is, "Where were you born.", put in something like "The North Pole", or "Europa". This will frustrate anyone who knows the real answer.
- Go on to Password and change it to something difficult to guess.
- Now click on the Devices link in the left column. Click on the device you don't recognize. On the resulting popup, click on Remove from account.
Log your devices out of your account and log back in with the new password.
To really double-down on kicking them out. Now login to:
https://www.icloud.com/
Click on the Find iPhone button. Login to FindMy with your new password if necessasry. If the unknown device appears, which can be any iPhone, iPad or laptop/desktop computer, tap its ! icon. Remotely erase it and put it into Lost Mode.