After doing some optimization to get our NIS map "refresh" process to take less than 3 hours -- it takes 15 minutes now -- we're now refreshing the contents of our maps nightly.
This means that accounts that are supposed to be "deactivated" will actually be deactivated when they're supposed to be, and "leavins" left from account renames and other odd operations will also get cleaned up.