>and one other way (the way we did it, boot into recovery and format it, then go through setup with another iCloud account which apparently just temporarily lets another user use the machine).

If you go through recovery, you can delete the content, but when you go to reinstall, you will be prompted for the credentials for the user tied to it.

Meaning, you can delete, but you can't reinstall without being prompted for authorization by the account that currently 'owns' that computer.