Microsoft, Rackspace and other hosted providers allows people to RDP into that server.
Here are a few examples: Microsoft has something called "Azure Connect" it is very easy to expose a domain connected terminal server to the Internet by simply pressing F5 to compile in Visual Studio (albeit with certain prerequisites taken care of).
Also, IaaS hosting companies (Rackspace, AWS) expose RDP for each VM they provision.
Generally speaking about RDP:
Is the computer or NETBIOS computer name exposed though any RDP channel in 2008R2?
Does the information exposed change if NLA is enabled/disabled?
What threat mitigation actions should be done?