This is caused by having no password or a blank password for the AppleShare Administrator. In AppleShare IP and Apple File Services under Mac OS X Server, the Administrator's password can be used to log in to any user's account. If this password is left blank, a user will be able to log into any active account without entering a password.
This feature is provided as a convenience for server administrators, but for this reason it is important for the Administrator to avoid using an easy-to-guess password.