We are using a custom field "Termination Date" on the user and check for that every night. A process grabs all the timesheets after that date and if there are no hours encoded on them, they get deleted otherwise, the local admin team gets informed. We also delete any auto-created hours (e.g. Public Holidays, PTO) after the termination date. If everything is clear we de-activate the user.
I like the idea to also do a sanity check on assigned work items that are still active as well as checking if the user is still set as project owner/sponsor on any active projects and have just added this our backlog ;-)
