We had this problem a while back
This was before massive pen drive use, and as previously stated we wouldn't let anyone run an application from a pen drive now, but the same problem can occur from cd's or the student's area.
We put a security key on all workstations, and on the servers we set them up with a separate password as well. Net support is a fabulous application but students can download the exe from the internet and once in they're away.
By the way at the time we got a lot of worried reports from teachers who said someone was taking over their desktop because their mouse had a hair in the sensor!