The Web Application Hacker’s Handbook Discovering and Exploiting Security Flaws

This type of flaw can also be found in some security models that

require dual authorization for security-critical actions. If an attacker can create

a new account and use it to provide secondary authorization for a malicious

action that he performs, then the additional defense provided by the model can

be trivially circumvented.

It is also worth noting that even without the facility to delete audit trail 

entries, the ability to create other powerful user accounts may make audit trails

difficult to follow, potentially requiring a large number of entries to be traced