Another option is that you provide the IT department with a corporate purchasing ID and demand that IT--and IT only--purchase and install apps using this ID. That removes the danger of employees abusing an Apple ID (unless those employees work in the IT department), but it doesn't address the cheating issue plus it then forces everyone to run to IT whenever they need a new app. This is a great inconvenience to employees and an unnecessary bother to IT, who have bigger fish to fry trying to keep the Windows boxes running.
Regrettably, what this issue really needs is action greater from Apple than the App Store Volume Purchasing program--a method for transferring licenses. It wasn't such a big deal with iOS apps in that the vast majority aren't intended for business use, but with the advent of Mountain Lion and Apple's push to direct users to the Mac App Store (and the many business applications within) there needs to be a method for license transfer.