Well, I'd suggest using a long (at least 8 char) password on the share, and perhaps with an underscore or something funky somewhere in it. If you have some sort of personal rule-based firewall, like Tiny's Personal Firewall or Conseal, you could block any incoming traffic to 137-139 (UDP and TCP) except for their address. Or if they have a dialup, the range of IPs they tend to have. It would cut down on risks by quite a bit, those two in tandem.
