This is the way the Samba recycle bin works by default, see https://www.samba.org/samba/docs/current/man-html/vfs_recycle.8.html
You could try to change the directory_mode via the include.conf file so nobody except Administrator has access, see also AD LDAP binding error (strong authentification required) - #4 by davidep how to customize include.conf.
Another idea is to put the recycled files on another share where only Domain Admins have access.
In this example testshare1 is the share that the user has access to and testshare2 is only accessible by Domain Admins. To set the recycle bin location for testshare1 to testshare2/<Sharename>/<Username>
net conf setparm testshare1 recycle:repository /srv/shares/testshare2/Recycle/%S/%U