You can't even buy a Mac without a CD burner, so what's wrong with during the install "insert a blank CD now to make a recovery disc; don't lose it!"

Obviously if you have physical access to a machine you can root it, there's no way around that, but at least make it harder than "boot off this easily-obtainable CD". Make it require a screwdriver. Make it where you can't do it without it being immediately obvious to whoever is guarding the machines that you're doing something you shouldn't.