Yep. They've been logging in under the sysadmin role for a long time. It's only when I change to anything from bulkadmin to setupadmin that they can't. This behavior doesn't crop up when using SQL logins, though.