The card can be re-flashed from the running OS, and actually runs a number of open source network daemons with known vulnerabilities.
It can interact with the BIOS, provide network access to the console, access the network via the host's ethernet chipset, supply the OS with pseudo-disk devices (CD-ROM, floppy) ...
[1] http://en.wikipedia.org/wiki/Intelligent_Platform_Management...
You can set up a limited number of users, like 16, and cannot store or access random data (i.e. you cannot use it like a 1GB USB drive). Of course, you could image that data, as there are tools under Linux etc. that let you read the IPMI / LOM / iLO information.
The module's capabilities are not all that different from OpenWRT; they run Linux, have a network connection, provide a web UI including a 'VNC' server for the VGA console, run (IIRC) net-snmp ...
If I wanted to obscure my intentions, I definitely would leverage such non-obvious embedded systems.