I'm not surprised...

I bought two Cisco 1600s off Ebay to practise ny CCNA course on. Both still had their original configs on (ISDN, access lists, the whole lot) from the building society they'd been taken out of. One quick password recovery later and I could read the whole lot (which I erased, obviously).

Thing is companies just trust external contractors to get rid, there's no checks and no comeback. Frightening thing is the same goes for the Govt. It used to be that you could only delegate actions, not responsibility, now it seems you can abdicate responsibility completely by passing the dead bodies onto someone else and then denying all knowledge. Outsourcing really does benefit someone - higher management!