Worms, such as the recent Slammer worm, can scour the Internet looking for SQL Servers on port 1433.  If it finds your client's server, and without a password on the...