So it could be that they create a mysql "database" for each user, and give them all the privileges needed there, and no privileges anywhere else.

And conceivably you could have some kind of proxy that looked like mysql but actually sanitized/logged/whatever any queries, before passing them on to the real server.