A lot of the comments here mention what to do with the server, but it's often more probable that a workstation controlled by a user that happened to have access to that server was compromised.