Outside member able to push to our project

We curious with one of our developer than can still doing push to one of our branch that her username not listed on our project member. How she can do that?

We have set that project to private mode and she use different username and can easily push. What I missed here? Please see our configuration bellow.