Sorry to dig up an old thread. Was an interesting topic.
I once had it happen when getting a new box from a provider. They put it online, emailed me, they set it up wrong, so I emailed them back and asked for a new IP assignment, this worked, I got notification and between me getting the notification and logging on the box was hacked, compromised and launched an attack on my provider. :-s I didnt even have chance to log in my self. OS was re installed

and no damage done because the box was brand new.
Other times hacks have happened was sites using unsecure code and their own site got hacked because of a bad script. Never had a server in production hacked though and no other sites vulnerable scripts have caused problems to the server or others sites on a server.