It appears that's not a dotlrn bug but a core one. The script to add a dotlrn admin (packages/dotlrn/www/admin/admin-add-2.tcl) does:
group::add_member -group_id $group_id -user_id $user_id
and the one to remove (packages/dotlrn/www/admin/admin-remove.tcl):
group::remove_member -group_id $group_id -user_id $user_id
It looks like the user is removed from the group but permissions on child objects are not removed or something like that.
