No idea unfortunately. When I said "misconfiguration of the server" that was pretty much a direct quote.
When I suggested that their apache server might be running with no privs I received no response, which I found to be rather rude. I don't mind being told that I'm wrong or don't know what I'm talking about, provided they justify it. But ignoring a suggestion (which was phrased as a question) I find to be unprofessional. </rant>