I created a subsite on a WSS server with restrictive security. It all
seems to work - except the site admin can see everything, even though
he's not a member of any of the groups setup to access that site.
- Security inheritance is turned off.
- I've validated the membership and rights of the groups.
- I tested with 2 members of the parent site who are not site admins;
they are unable to access the subsite.

So can a Site Administrator see everything by default?

Running WSS 3.0, NOT SP1 (yet).