[Scarbutt]

You really have to go out of your way to make the www-data user available through ssh, weird some do this.

[kjs3]

I can tell you exactly how it happened: someone thought that this was the most expedient way to do something they wanted to do, they unfortunately had rights to do it, and they just did it without considering for a minute the consequences. Happens all the time.

[linuxdude314]

My thoughts exactly. For someone responsible for a system to do this is such an act of gross negligence, and demonstrates such a lack of competency I would be remiss to keep the person at the company were they my employee.