After the creating first user. Test1. By being in the system , grant him GRANT CREATE USER TO TEST1;

After granting that, connect as test1 and Create user test2... would work. However you cannot grant connect, resource to TEST2. So connect again as system and grant test2 the connect and resource. Good thing about this is, your hierarchical thing works. You can query the table of test2 by logging as test1 and cannot query the contents of test1 when logging as test2 and the process continues to test3 , test4 ..

Hope this helps...