User levels bursting over the licensed level does not change the operation of the device (or I should say, it never has for me). I always felt choosing user count was awkward on the IronPort, but my own stance that is if you did a good faith effort to license appropriately, you are fine.
Interestingly, the next generation of the IronPort, the ASA CX, does not license per user, but rather licenses per instance of the software on the ASA.
Hope that helps,
Aaron
