They're done irregularly, and pretty much "when we remember and when the sysadmin(s) have a few hours to babysit the process and make sure nothing gets screwed up" -- running the expunge-users script is a bit of database load, so we try not to do it too frequently, but it has been a while. I'll nudge people to add it onto the to-do list.