If you can't trust your System Administrator you are in trouble. If the data was that important you'd also have other controls in place. I don't think this is really a security hole. A system/enterprise admin could also create a generic account and do damage to any system that he wished thorugh assigning him/herself to any security group or policy. This is a person in a position of responsibility being malicious. If a server was put into single user mode a DBA would know about and an investigation would take place. They wouldn't get away with it.