https://freek.dev/1940-why-and-how-you-should-remove-inactive-users-and-teams

makes some good points about deleting inactive users.

1) reduce db size to improve performance

2) eliminate potentially private info about users

https://fossil-scm.org did something similar in purging mailing
notifications if user has not interacted with the forum in 6 months.

Now we usually retire rather than delete users to maintain referential
integrity. Even retiring users is a performance win. However if the
user account was never used, it could be deleted outright. We would
need to check for references to the user in issues (properties:
creator, actor, nosy ...)  as well as references in unpurged
history/journal entries.

issue2551133 discusses some changes to wipe/purge users by overwriting 
user
info, purging history/journal for the user entry and retiring the
entry. Retiring the entry removes it from being displayed in dropdowns
and reducing the data returned by db queries.

In any case this ticket is to create code that will:

  1) identify and mark users for deletion or purge
  2) notify the users via email (using primary or alternate emails)
  3) add a mechanism for the users to respond and prevent being
     purged.

Roundup has no mechanism for determining last logged in time AFAIK.
Some indication can be gleaned by looking at recent issues (e.g.
issues with activity newer than 18 months ago). Scan the journal for
those issues noting the actor/user for a change. That may be a
starting point for identifying active users.

This would probably be most useful for public trackers.

Internal trackers with just employees would presumably be able to tell
when an employee leaves and retire them as part of the process.