Envato plugin in WP without access

The Envato plugin was installed in a WP panel that I don’t answer anymore and I don’t have access.
Can this customer use my account to download photos, kits, etc without my permission?

If you gave the full permission, yes.
You can just go to Envato API page and remove/reset the API credentials. This should solve your problem.

Next time for the purchases on behalf of the clients, you should get a new account and do the purchase on the new account - then give the login details to the client.