McDonalds China IIS 5 Server defaced

A McDonalds IIS server was defaced by a Chinese hacker angry that Taiwan was listed as a separate country on their server. They were lucky that is all they did. The server reports it is a Windows 2000 server running IIS 5 so I'd be curious as to what the administrators missed that this defacement was possible.

www.mcdonalds.com.cn is the domain.

Story at http://www.reuters.com/newsArticle.jhtml;jsessionid=ER4RDJFPRL14UCRBAEZSFFA?type=internetNews&storyID=7186150