More than likely he used a converter that allowed him to convert a serial port to a usb port....Under GPO rules this would not be a blocked USB port.

http://www.coolgear.com/images/USBG-4.jpg

You will need to set up a new set of permissions to block this type of situation.....or shut down all the extra ports through the BIOS on each computer....or deny installation of USB drivers through the registry settings...which can be done as a batch file.