Settings → Security lists every session with its device, IP and last-seen time. Revoke any individually, or sign out everywhere else in one action.
Sessions are opaque random tokens in an httpOnly cookie.
Two events destroy every session, both deliberately:
- A password reset. The whole point is that whoever had the old access loses it.
- Suspension or ban. Without this the action would do nothing until the existing cookie expired.