Apparently they left the admin site completely open to the world, and the URL was sniffed out by someone in the audience at Macworld.