I had a similar experience. Bought a 1U server on eBay. It was apparently the central controller for the flight information displays at a big airport. Lots of plain text passwords for upstream services in config files, etc.