Both of you are right.

sp_validatelogins doesn't list the logins that have been DISABLED in AD.

It only lists the loigns that are DELETED in AD.