One of the fundamental tenets of security is that you cannot protect a system from the administrator of the system itself. This is because the administrator has the means to modify/control the system, so he can always find a way to access anything he wants.
My advice to you would be to advise your client to reduce the number of their domain admins to a realy small number of people they can trust. As suggested by comrade Schroeder, it is always best to delegate other parts of system management to other delegated admins based on a good delegation model.
One thing to keep in mind about delegation in Active Directory though is to make sure that the Domain Admin accounts are not in the same OU as other accounts, because if so, and you delegated administration of that OU to a delegated admin, that delegated admin could use permision inheritance to grant himself enough permissions on the Domain Admin account to reset the Domain Admin's password and login as the Domain Admin. (This concept is not new and is known as "Active Directory Privilege Escalation")
So comrade, my suggestion is to reduce the number of Domain Admins by delegating all other tasks (e.g. account creation, OU management, group membership management) to other delegated admins, and only make those people admin who you can completely trust. (As suggested by other comrades, neither logging nor auditing protect a system from a Domain Admin because a Domain Admin can turn them both off.)
Good luck to you.