"Via Group Membership" is interesting to me.  I've wondered if it happens when someone has db_owner rights via a Windows group and then creates an object.  You can give a group access to a database, but I bet when they create an object under their owner, then it needs to create the login and uses "via group membership" to denote that you didn't add it yourself.

When you remove BUILTIN\Administrators group and your server/network people want to take the box down for maintenance, do they call you to stop SQL gracefully, or do they just pull the plug?