ITIL is not the only role that requires a license as such, so you would need to remove all roles for inactive users

In addition, I don't think we alert somebody prior checking their current license count. And yes, if some script guru wants, I am sure he will find a way to cheat this. Not very ethical, and probably not a customer for us going forward once we find out about it.