"test users who have the role of student are never asked for the enrolment key" - have the role of student where? You mean they're students of the course? Then they have access without the key. That's the purpose of the key - to provide access for people who aren't already participants. Once they're in, they're in, even if the key is subsequently changed, unless unenrolled.