Avoid groups admin from being able to assign quotas freely to the users they create. Maybe limit it with an "assignable quota".

Avoid groups admin from being able to assign quotas freely to the users they create. Maybe limit it with an "assignable quota".: When you create a group admin, this group admin can create new user accounts. And he can decide what quota those new users might have. So he can effectively create a new user for himself with unlimited quota or just give the new users more quota than expected.