Thanks for the reply; I actually posted this for a colleague of mine so, I don't know all the particulars. I believe those other things were checked and there were artifacts indicating those users were once there but I'll have to ask him.
Upon looking at the local user ids there are two that are not there (1002, 1003). I have searched event id's 4726 and 4743 finding nothing. Any way to determine if the event logs have been altered or somewhere that may show who, what, or why these accounts were removed?