Tip: Have a script that has several administrative passwords. Give everyone a different one. When undesirables get admin mysteriously, check which password they used. Check your list to see who you gave that password (after disabling it, of course), and begin the baking (normally it'd be roasting, but I prefer my legos well-baked).