SharePoint: When is an administrator not in the administrator group?

Even if you remove a user from the Administrator group in Windows Sharepoint Services, it's possible that they could still have some level of administrative access if they are the owner or secondary owner of the top-level site. See this TechNet article on Windows SharePoint Services Security Model.

Note The owner and secondary owner of a top-level Web site may be members of the Administrator site group for their site, but they are also identified separately in the configuration database as site collection owners. This owner flag can only be changed by using the Manage Site Collection Owners page in Central Administration or by using the siteowner operation with Stsadm.exe. If you remove an owner from the Administrator site group for the site, the owner retains the owner flag in the database, and can still perform site collection administration tasks.