Sadly, my 250th blog post isn’t fully an original post but just a link to an awesome blog post someone else wrote, but it’s a good read:
Find My Mac

The only two things I’ll add are these:

If you want to clear everything out (say, if you’re re-imaging a machine… not sure why you’d want to keep any firmware variables around), you can run

which will delete all firmware variables.

If a user signs out of her iCloud account before you re-image a machine, it will clear out the fmm-mobileme-token-FMM firmware variable but not the fmm-computer-name. That’s likely sufficient to prevent a future lockout, but you may want to run the previous command to clear out all firmware variables just in case.