Does it do it for all test accounts and users?
Make sure the test account isn't also listed as an admin for the site or
noted as a Site Collection Owner (if it is somehow assigned that, it will
have admin rights no matter what site group the account is assigned to).
Does it do it on a newly created subsite?
Heather Solomon, MVP WSS