Yep. It was also a project where we rolled our own...everything. This was an AJAX project before Prototype, jQuery or even JSON was popular so we had a lot of explicitly mapped paths and code that only didn’t exactly what was needed and verified every argument.
10 years is a long time in security. Presumably that's what the maintenance was for?