We've had a similar situation arise a couple of times: we have an "observer" role which allows the user to view content but not interact. In a couple of cases, a lecturer has assigned this role to a student to allow them access before their enrolment has officially been processed, and didn't remove it later - so the students did practice attempts instead of real ones.
If caught early enough that the preview attempt is still in the database (and you have direct DB access), you can turn it into a "real" attempt easily enough - but preview attempts can be automatically purged for a few reasons, so it needs to be caught early for that to be an option.