A primary rule of computer security is the physical security of the system. It is a lot easier to steal data and subvert a system if you can gain access to a console, the network connections, or the physical drives.
You have to imagine that someone may have gained physical access to the server and imaged the drives. Without an alarm system, you could sit there all night long and do it.