Hi!

This is a minor annoyance only.  I feel it's a bit unsafe to not remove the file
/var/run/sudo/$USER after the user has logged out.  Logging in again in a short
enough time frame will allow that user to use sudo again.  

It's a bit outside the scope of the sudo package, but consider a user logging in
to a rempote host to sudo a command. The user logged in using insecure telnet
and the password got snooped. The attacker monitors the connection and logs in
posing as the user and could potentially get root access because the $USER file
in /var/run/sudo/ still remained.

There are a lot of flaws to my reasoning above, but I think you get my point.

Maybe a note in the man page could be inserted about this so site admins could
add some cleanup script to each users .bash_logout or such. Again, probably not
a suitable solution to use .bash_logout but you get my drift by now.

Regards
 /Jocke