Service accounts can become invisible administrators

Accounts created for software frequently end up with high privilege, non-expiring passwords and no owner.

Nobody logs in as them, so nobody notices them. They do not appear in leaver processes. Their passwords are old, sometimes weak, and sometimes discoverable by any authenticated user in the directory. They are among the most reliable routes to privilege in a mature environment, precisely because they are boring.