Incognito doesn't mean popups will happen it keeps no history and clear the cache when closed. Since no one is there to see what happened of what one did this makes it harder to know what was going on at the time. The fact the partner denies the claim is suspicious itself. Sites can't open unless a user goes or click on a link. The best way to not let another use your profile or account to do unsavory sites is to if on Windows 10 or so is to password protect your Admin/Owner account as if the other member is doing unsavory things with your account eventually it will get infected for the Admin account and then worse reformat is needed to wipe clean the infection. So password protect the Admin and your standard user account and if they need to use the Browser then make account for them to use and if they infect their account then just delete that account and start over. But for this instance I would password protect the Admin and not use it but make standard account and use that for everyday purpose.