but Chip I think that is exactly the OP's issue. Someone is going in and "authorizing" / performing the deletions; to the receiver the "keep until I delete" is being observed; at least that how I read it. I see no way to password / parental lock that part of the menu for only an ADMIN's use; which would be nice. If I misread the OP's issue; then my bad.
Well then it's time to have a little chat with the delete-aholic! It sounds as if there are some issues here!
Agreed 110% - I have a serious hands off policy with all my electronics gear. Family or not!