At a transaction, RFC, WebService or WebDynpro level you can compare the authorized functions to the ones in their menus and then compare them to the statistics database. That produces nice colourful ALV lists and excel sheets in the reports we have for this.
At an individual authorization object and field value level, you will have to wait a little while still for a kernel patch which will hopefully come soon. It will make it possible for you to simulate the affect of successful or unsuccessful checks without them actually failing. This means you can also over time gather what a user has for authorizations but does not use...
I am also waiting a long time for this. I will update this when it is available.
Cheers,
Julius