There is no 'owner' group in Ulysses, and superadmin and admin access are controlled by the server, not the client end.
If you do a "ulx who" while you're connected to the server and people are showing as anything other than user, someone has figured out your server's rcon password or using some other exploit (though possible, most likely NOT associated with ULX)