Lab Computers

That's kind of a tough one. There isn't a way I'm aware of to change Safari's behavior and make it quit when the last window is closed. Some apps do that, and others don't.
Also are we sure it's really the "last window" we're talking about? It's possible the students are closing their email window or tab and leaving others up. But it sounds like maybe they 'red x' all windows and think they are done. Is that the case you'd say?

Only thing I can think of off the top of my head is to use a LaunchAgent that can run periodically to check if Safari has any open windows, and if not, quit it. You could have it run on a 30 second interval for example, which I think would be sufficient to catch it before any other student sits down at the same Mac.

Presumably they are all using the same username / password to access the machine then?
You might be able to configure Safari to always open in private mode.
Failng that you might be able to launch it with a command line that doe the same thing, then create a shortcut/icon that runs this.

According to it's description a Safari Private Window will delete all it's history etc... when the window itself is closed to if you can get Safari to open one then you should be okay (unless they close just the tab of course).

@Look The Private browsing window option is a good idea. I didn't think of that and I just looked into it. Interestingly, there is a plist key for com.apple.Safari.plist that can be set to enable the Safari Preference option titled "Safari opens with: A new private window" but sadly in my quick testing, it only works when Safari is launched each time, meaning if all windows are closed and you click the icon in the Dock, Safari pops open a new non private browsing window. There doesn't seem to be a way to force it to always open a private window for every single window or tab, just the first one on each launch.

In case anyone is interested, the preference for this is labeled OpenPrivateWindowWhenNotRestoringSessionAtLaunch and takes a boolean value. True enables it. To set it with defaults you would do

defaults write com.apple.Safari OpenPrivateWindowWhenNotRestoringSessionAtLaunch -bool true

Also, it doesn't look like a Config Profile can enforce the setting. It can apply it, but won't lock it in place, so it's trivial to go into the preferences and disable that feature anyway.

It'd be nice if Apple actually gave us a way to force that to be the default for all browsing sessions. I mean, Apple is so into protecting their customers privacy, but they don't see fit to give us a way to set this as the default, which is annoying.

Forgetting to log out of email is only one naive scenario. Even if Safari private browsing addressed that, it still wouldn't address many other scenarios. An example would be if a student downloaded an attachment and didn't delete it. There are a lot more serious scenarios though. First thing I thought of is bullying where something is being shared on purpose.

Personally, I wouldn't try to address any of these on a case by case basis. If a shared account must be used, then it may make sense to use a config profile to force a logout after a number of minutes of inactivity and put something in place to completely clean the user profile on logout. Something along the lines of what a Guest account does. This way you prevent data in user folder being left behind including browser sessions.

This still may not be perfect but thinking along these lines at least moves you away from handling each situation as you discover it. At the same time, it makes inadvertent as well as purposeful scenarios harder to happen.