I am sure missing something: couldn't you just remove yourself your profile/BMW ID before returning the car ? I guess the answer is yes, but you are stating that somebody could act like you in purpose so to have control of the car when is in somebody else hand?