Sudo has to be the most misused security tool out there.
I cry a little inside every time I go to a server and I see:
whateveruser ALL = NOPASSWD: ALL
That’s the same as logging in as root directly and pretty much defeats the purpose of sudo and all the options it provides.
If someone needs unrestricted sudo access (like your sysadmin), please force a password on sudo and disable password authentication on sshd, so he has to SSH in via keys.
That way you are enforcing two methods of verification (key for ssh + pass for sudo) to get to root.
If you want to be more paranoid, set a written policy to prevent someone from doing “sudo su”, so he has to run sudo before every command he runs as root. That way you get a nice audit trail of every command being executed.