Duo got bypassed

So i created a User for a developer to log in and fix an issue right.

A admin user via wordpress and duo did pop up for him but asked him for his cell so he put in his own number cuase he has duo.

So then duo allowed access but why was i not notified via duo except for an email

how do i block it from allowing outside users from just using their numbers and bypassing me..?

otherwise no point caus a hacker could just create a user and log in>?