Volunteers bring personal devices, share login credentials, and leave without a formal offboarding process. Each of those patterns creates an opening for attackers. Here is how to close them without spending much.