When viewing a user and going to "Edit Groups", it seems that Confluence loads all the groups from the LDAP repository (which can be very bad for LDAP servers with a huge number of groups.
Here is the associated log message (as an example):

2007-03-20 11:52:53,703 DEBUG [http-8080-Processor4] [impl.ldap.adaptor.AbstractLDAPGroupAdaptor] search Searching for groups using base name space:ou=groups,dc=example,dc=com and encoded filter (&(objectClass=groupOfNames)(objectClass=groupOfNames))

Confluence shouldn't need to look up all the groups.