The button links to the Frontstep website, so it appears to be by design. Once IE is open though, the user can go anywhere they want. i.e. Check sports scores, My Space, etc., all on the server's dime.
It is a gaping security hole that we never considered until we caught it being exploited.
Greg