People with empower are able to empower abilities to others that they themselves do not possess. Example: If I'm empowered with only the "empower", ability, I can empower it to a friend, and he can empower me with all the other commands. There is no check to make sure you HAVE the actual ability you are empowering to the victim.
if( arg2 == '\0' || !str_cmp( arg2, "list" ) )
ch_printf( ch, "Current bestowed commands on %s: %s.\n\r", victim->name, victim->pcdata->bestowments );
Directly under that, add:
if( !is_name( arg2, ch->pcdata->bestowments ))
send_to_char( "&RI don't think you're even allowed to do that.&W\n\r", ch );