Currently, Box allows an unmanaged user to become a paid Managed user "automatically" if someone within the domain invites another email within the same domain. Only Co-Admins and Primary Admins should be able to authorize a paid seat. Or there should be an option in settings to turn that on ability on or off.