A Shared mailbox has no password and is accessible only by User mailboxes (in an individual's name) with access rights.

There are two level of access; Members & Owners.

Members (Basic access)

A Member can access a Shared mailbox; reading/sending/deleting emails and managing folder structure etc.

If you are a Member of a mailbox, you are responsible for ensuring it is adequately monitored and items suitably actioned.
See NHSmail guide: Opening shared mailboxes

Owners (Elevated access)

An Owner has all the rights as a Member and must also be responsible for adding/remove Members and other Owners to the mailbox. This can either be done either with requests to NHSmail Local Administrators or more easily and directly done in the NHSmail Portal.
See NHSmail guide: Managing Shared mailboxes (How to add/remove Members and other Owners)

When did you last check your Members fellow Owners access rights? 

As an Owner, you should check the Owners/Members in the NHSmail Portal as staff come, go, or change role and add/remove as required. It may also be advisable to set a recurring reminder to check your Shared mailbox membership at regular intervals as a safety net where this may have been missed. e.g. Every 2-6 months depending on your organisation rate of staff changes.

Important:

1. When a colleague leaves your organisation, their access rights to Shared mailboxes are not removed automatically. This is by design and allows Shared mailboxes to be used in collaboration across care services where a User might transfer between organisations without interrupting their access. As an Owner you must remove staff if their access is no longer appropriate. 
2. No matter the size of your organisation, we recommend there are never less than two Owners to every Shared mailbox. This ensures if an Owner is unavailable (which might include unexpectedly leaving the organisation) there is at least one other Owner that can perform these duties, including removing an Owner that has left and adding a new one.
3. Unlike a User mailbox, a Shared mailbox does not get deleted automatically if unused. A Shared mailbox will remain open and receive mail until the owning organisation actions the contents and requests it be deleted. The owning organisation remains responsible for the mailbox even if all Members & Owners leave and handover is not managed correctly.