Honestly, this seems like common practice with a lot of dedicated providers. Their less tech-savvy customers may not even login to the machine or even know how to. First step you should take when setting up a dedi is to remove any sort of access from the provider for this exact reason.