Ironically because of a flaw in Adobe reader #2 is also a security hole which allows malicious 3rd parties to run arbitrary javascript on your domain.

You should force all PDFs to download.