Hi Randall,
This is expected behavior as the Create Database User tool per the help;
"The Create Database User tool creates a database user with privileges sufficient to create data in the database."
The tool grants the following in the permissions in SQL Server for the user created:
CREATE TABLE
CREATE PROCEDURE
CREATE VIEW
VIEW DEFINITION
http://resources.arcgis.com/en/help/main/10.2/index.html#//00170000017r000000
These permissions can be removed from the SQL Server side and the user will no longer be able to create data. Editing and viewing permissions are managed solely in ArcCatalog.
As for a tool to remove database users I am not aware of any at this time. They can be unmapped from the database in SQL Server Management Studio.
Please let me know if there are any further questions