Actually, there's an even easier fix: don't put those tools outside the firewall. Use VPN, or even just a tunneling proxy or SSH to protect your admin console.

Actually, there's an even easier fix: don't put those tools outside the firewall. Use VPN, or even just a tunneling proxy or SSH to protect your admin console. This is a classic security failure, and their response was both typical and appropriate: take the tools offline, restore the affected accounts, and admit your mistake (in that order).