Do you give out the Administer Users permission on your Drupal websites? Did you know it's just as dangerous as Administer Permissions, as dangerous as giving access to User 1?
Imagine: you're about to go live. The client calls up, he wants to create users for everyone in the office. Even though the client is not a 100% trusted user (since no-one is), there is an easy solution for this: Administer Users.
Indeed, unless you implement some contributed modules, this is THE solution provided by Drupal core... Wait, read on!