Even dead employees pose a security risk when their accounts are still active