Yes. They should perhaps dispose of that server when returned, or thoroughly examine all the firmware and such for changes. A hostile party has touched it.