When you break inheritance and grant permissions to a user at the
subsite or document library level, MOSS automatically grants the user
the 'Limited Access' permission level to the root of the site. This is
so the user can access stuff at the root that is needed to render the
subsite or library.

With permissions for the user in place at the subsite or library level,
the system will allow you to remove the site level ('Limited Access')
permission for the user, and will remove with it any subsite level or
document level permissions. This is probably a good thing, as it will
prevent 'orphaned' permissions from being left throughout the site
hierarchy. However, when you remove permissions for a user at the
subsite or library level, the 'Limited Access' permission for the user
remains at the site level. This is true even if the user has no other
subsite level or library level permissions in the entire site.

I would rather that MOSS cleaned these un-needed permissions out, but we
can live with that and clean them out ourselves. There's this problem,
though: if we inspect site-level permissions and see 'Limited Access'
permissions in place for a user, how can we know if there are subsite
level or library level permissions in place for the user? How can we
know whether it should be cleaned out or not?