The user who is the Farm Admin (of an SP2013 farm) has access to all the site collections within a certain the web app on port 80. I can't figure out why this is the case since this user is not setup in the User Policy of the web app, nor does the user have site collection admin access or any access of any kind granted via site permissions. If I go to Check Permissions it says that no permissions have been given to this user, however, right below that where it says there are additional factors that affect the level of access, every permission level has been Allowed. Any other reason the Farm Admin has access to the site collections within this web app without have a User Policy at the web app level or any site collection permissions?
Actually there are two type of farm admin(administrator) account which confuse the thing.
Farm Admin Service Account: This is account which runs the timer services, App Pool for Central admin and other important task, also have DB creator and Security Admin rights on the Sql Server. You cannot limit this account, it should have access to everything in farm. This is typical services account.
Farm Administrator: This account refer to the sharepoint administror of the farm like us, these accounts are usually user account and they just explore the Central admin. A user with Farm Admin rights is not automatically granted rights in Site Collections. To bypass having to add the user to every Site Collection, in Central Administration go to Manage Web Applications. Highlight the Web App you want to give yourself rights to then click on User Policy. Add your user account with Full Control rights.
Farm admins defined in Central Admin will always have full access to everything in the farm, because they are by nature, farm admins.