There are tools (Score 1)

We run in an Exchange environment. Our company has a lot of turnover so we used an app called ESRA to kill legacy permissions (like the account is deactivated but for some reason the user had strange access rights). I suppose this app could do the same thing...

....end commercial :-/