Security issues don't come from the presence of "anonymous" user accounts, but from user actually using them to perform actions (because then the user are not longer accountable: logs will tell you "Administrator did it" and not "Bob did it"). Logging as some account simply means knowing the associated password and using it (however, accounts can be locked down by preventing their use for interactive sessions; that's done with GPO).
The auditor is having a knee-jerk reaction: he saw "many" such accounts, and thus spewed out the generic warning about anonymous accounts. However, this is somewhat misguided: the number of such accounts is not the problem; a single anonymous user account can be enough to lose accountability. It is just that the auditor thought that the presence of all these accounts is somehow indicative of a widespread local tradition of using anonymous accounts. A more thorough auditor would have analysed behaviours, to see if users actually use non-nominative accounts in their daily jobs, instead of mindlessly firing up "Active Directory Users and Computers" and counting the accounts.
On a general basis, you may want to "lock down" non-user accounts; a simple way is to make sure that no human knows the corresponding passwords. If the password must be entered as part of a configuration operation, then the password should be retrieved from the safe where it is kept (printed on some paper). Since such passwords need not be remembered, and are typed infrequently, they can be long, fat and random.