An exchange operator that operates both the exchange its self and its web-facing front end from the same server(s). You really have to wonder what they were thinking?

While a front end compromise is always going to be bad, splitting the two gives you more options and more ability to spot when the front end is acting unusually.