You should use @PrePassivate and PostActivate callback to properly manage resources used by a bean. Note that for example if Stateful bean times out during passivation, its resources remain open (if not released in PrePassivate).
The PrePassivate callback notification signals the intent of the container to passivate the instance. The PostActivate notification signals the instance it has just been reactivated. Their purpose is to allow stateful session beans to maintain those open resources that need to be closed prior to an instance’s passivation and then reopened during an instance’s activation.
Also 4.6.3 for stateful session bean:
The application using the session bean should provide some clean up mechanism to periodically clean up the unreleased resources.
For example, if a shopping cart component is implemented as a session bean, and the session bean stores the shopping cart content in a database, the application should provide a program that runs periodically and removes “abandoned” shopping carts from the database.