If your jr admins are in a group, set in the default mail9.ntf ACL a entry of [GroupName] to no access.(yes with brackets)
When a new mail database is created, the GroupName will appear in the ACL and any member in the group will be denied access.
-make sure you set the GroupName document ACL (in domino directory) to only allow FullAdmins and LocalDomainServer to access to stop
Jr Admins from elevating their privileges by removing themselves from the group on the fly as well as edit FullAdmins or LocalDomainServers group documents to stop them from elevating themselves. (it's easy to lock yourself out so pay attention.. make a backup before you start)
If he/she uses the Adminp process to create the accounts, he/she will not be in the ACL at all in either case.
if you manually create a new db from the template, then the creator is the manager of the DB. (sounds like this is what's happening)
the Jr admin will have to run everything from the console for db maintenence and cannot access the mail file directly.
If the end user has a particular problem with a email and Admin eyeballs need to see it, the Jr Admin cannot help. (unless the end user grant's the Jr explicitly, from their mail preferences..)