Quite some time ago, I was involved in some work to figure out how to best disable an account in Mac OS X. It was a pretty interesting investigation.
In the end, we settled on two steps which worked for both admin and non-admin accounts:
Between the two — and I don’t recall whether both were strictly necessary — console logins were disabled, and remote logins were prevented from all of the sharing services that could be turned on in Sharing System Preferences.
When tested under Tiger, both of these were successfully cleared by the Reset Password Utility on the installer DVD. When the password was reset in this manner, the account was enabled for login.
While I haven’t replicated the results with Leopard, I have no reason to suspect a change (other than the adoption of DSLocal instead of NetInfo and the change to the DirectoryService superdaemon).
This is really handy information if, for example, you’d like to have a local admin account for emergencies but you want to force someone to explicitly enable it before use by booting from a system installer disc.
Update: It’s also important to remove any SSH keys that might allow logins to that account, if you want to fully disable access.