Hmm, I'm sure there are easier ways like killing the user's session but the CloseCommand (ehshell, MediaCenter.Home.CloseCommand) calls PageBasedUCPService.DefaultUCP.RequestClose(FormCloseReason.UserRequest). I guess you could start fishing there. Damian Mehers has an injection example illustrating how to get the DefaultUCP which you could then call RequestClose through reflection.
Probably the bigger question is why do you need to do this?