There's also the default trace in SQL Server. I'd think it would log a drop of a user. I see a security event if I add one and then drop one

Here's a basic guide: http://www.sqlservercentral.com/articles/SQL+Server+2005/64547/