Do Access Reviews Mitigate the Risk of Privilege Creep?