I'm uncertain how feasible it is to construct an automated solution which doesn't have to rely on heuristics and observing/parsing various bits of /proc and /sys.
I/we use RealVNC (Xvnc) on RHEL4 and the free version of RealVNC tends to do as you describe (I haven't yet seen the commercial/paid RealVNC do this). It seems (I don't have anything better than anecdotes to support this) that it's for us is an interaction between (ancient) gnome/metacity and Xvnc that sometimes trigger this, as I convinced some users to switch to XFCE and they haven't since been troubled by this.
What I'm currently doing (the quick-and-dirty solution) is by the magic of python looking up processes with /proc/<pid>/exe pointing to the Xvnc binary, parsing the logfiles pointed to by fd 2 by the processes to determine how long it's been since the user actually used the session (and in the case of a deleted logfile, assume process start, and notify as such), and then kill off Xvnc processes that's been unused for a few weeks.
What I'm considering doing is doing this a bit more stateful, by occasionally sampling /proc/<pid>/stat to look for Xvnc processes which sustain an increase in utime close to wall time over a longer period of time and use that as my heuristic instead.
Ideally, I'd like to find the underlying cause of this, but the absence of time (and will) to dive into the guts of Xvnc, I'm currently just alleviating the symptoms.