This is going to be messy to clean up later.
If you forget to issue REVOKE CONNECT FROM ur_login_name for any databases thats being created from now on, you're in trouble. I bet someone will forget, if not you, your assistant, a 'helpful' administrator when youre on vacation etc. This can ofcourse be remedied by at job, that goes through every database and issues this command. But how often, once a day, well you have a security breach for average 12h. Not acceptable in my opinion!
Furthermore he is able to DROP other databases. Do a test, create a database with sysadmin account, and then try to drop in GUI, wont work, but open a query, and write: use master; drop database NewlyCreatedDB, again not acceptable!
I would suggest that you either trust the employee and educate him/her, or accept the fact that restore of databases on a regular basis requires the time from a trusted DBO.
Your only option outside of this would be to create an instance, move the database here, and let the user run this instance with sysadmin credentials.
/Marten
