SAL (subscriber access licenses) can be complex and without question the number one underreported licenses under SPLA. Why all the confusion stems from misinterpretation of the SPUR and/or bad advice.
When you report by user, you have to take in account each user that HAS access to the software, not who does. Microsoft is not based on concurrent licensing. I wrote about this prior, but thought it was worth repeating. If you have 5 users that use the software, but 15 users can access at any given time, you must report all 15. Seems ridiculous, but is 100% true. Consider licensing by processor if user licenses become too difficult to track.
Read this section of the SPUR (use rights). “You must acquire and assign a SAL to each user that is authorized to access your instances of the server software directly or indirectly, regardless of actual access of the server software.” It’s the last part of that sentence that can get you in trouble “regardless of actual access of the server software” For a copy of the SPUR check out http://spur.microsoft.com/products.aspx