I may have been a little harse with the "idiot' comment...but to leave an account that powerfull open with no password...well

the guy atleast deserves a smack across the back of the head...

I have touched about 10 different SQL servers this year outside of the 15 I manage. Want to know how many of those 10 had the sa default and were using sa for the ODBC connection? Every single one.