I was reminded, yet again, today of the importance of proper password security. A customer had their site compromised, via an insecure password. In this case, it was an old account, that had not been used in quite some time, and they had forgotten it was there.
That points out the importance of deleting, or locking user accounts when an employee leaves. You should have a checklist of tasks for when an employee leaves, and one of the things on it should be to delete or disable all computer accounts.
Additionally, you should perform periodic checks of your systems, to insure that only the accounts that you actually need are active. Complex passwords should also be implemented, and enforced by the operating system, to require users to always use passwords that are more difficult to crack.
In this case, via the weak password on one account, hacker were able to get on, and install software that to recruit the system into a botnet. The apparent intent was to be used for Denial Of Service attacks. Fortunately, this particular system did not have a web server installed, and thus was not successfully recruited.