A DoD email server hosted in the cloud (and now secured) had no password protection in place for at least two weeks.