In 1.0, an "account activated" email is sent the first time an admin adds a user to a role. Now that there can be more roles, these emails get sent out a lot. There should really only be one email sent, the first time a user is added to any role.

And then if they're removed from all roles we could have it send an "account deactivated" email.