using an admin account should do the work I suppose.
It is designed this way as the pre/release task is provided by job user. There will be security concerns to have job user to be able to have system privileges on compute nodes.
In order to achieve your scenario, admin can put some monitoring process on every compute nodes to monitor job user request and do the work on behalf of users (For example, the job user write a file with the service name in a folder, and admin
create a windows scheduled task to run routinely to look for the file in the folder and do a start-service then remove the file)
Qiufang Shi