Because as an Admin that gives them quite a leg up on escalating their privs on the Domain as well. It is a Best Practice with Microsoft and all Large Enterprise Networks to not have a user with any higher privs than needed any where on your system.

That also makes it much easier for a remote hack into your network where they could easily gain the same rights as the user and as said above gives them a foot step into your network to work further.