peppogiappe there is a hidden user.delete permission which isn't available via the permission tab, but that you could set manually via the database.
This is a dangerous permission since somebody could use it to delete all admins.
There is some discussion about how we want to tackle permission levels in Flarum in the future here flarum/core1965