In windows, there are service accounts like HOSTNAME\IUSR which are able to run certain processes (IIS in this case). Are these accounts vulnerable to being broken into and starting a remote shell (for instance)?
What is different from these accounts than your average user account? Can you login as a service account? Do you have to be able to login to create a shell?