In an AD environment, the servers hosting your file shares are actually accepting the Kerberos ticket that was issued to your session with all of its authorizations when you were authenticated on login. This way, file servers don't have to contact the domain controller every time for access to it. It trusts the ticket. The fact that there does not appear to be any enforcement of revocation of Kerberos tickets appears to be inherent to the way Kerberos works.
http://msdn.microsoft.com/en-us/library/cc233947.aspx
Also, this recent article written about it:
http://www.aorato.com/blog/windows-authentication-flaw-allows-deleteddisabled-accounts-access-corporate-data/
The tickets can remain valid for 10 hours and the workaround in the MSDN article seems to only prevent access to new resources after 20 minutes in the same domain.
As far as VPN users are concerned, in a normal use case, although it can depend on your VPN architecture, the Kerberos ticket would be issued upon authentication, so under normal circumstances, they wouldn't be allowed access if they weren't already connected to the domain in some way with a recently (few hours) issued ticket.
That second link to the blog article may have a hint of hype to it, and I'm pretty sure I've seen people lose access to stuff minutes after I've disabled them --- although their ticket may have been about to expire anyway. This does bother me though, because there have been a few times where I've been told to disable a user's access to everything yesterday, and in some environments, that's critical.