Do you know what your IT manager's mother's maiden name is? No? Well, you may want to find out.

You have to trust the people you work with, and your IT staff requires even more trust. Like it or not, if you have an email server and a server administrator, your company secrets are in their hands. Unless, of course, you resort to government-esque tactics such as never using email. As long as your business interests are legitimate, you don't need to resort to such paranoia. Hire good people and trust that they're going to be worthy of the faith you put in them. You do want to make sure, however, that another person in the organization has access as well.

As far as contract work goes, you might want to include a password clause in your contracts. Just a simple statement that says at the conclusion of their work for you they will provide you with administrator passwords to all of the systems they install. Nothing terribly oppressive or threatening, just a little, 'when you're done, can you make sure and leave us the keys?' Better to ask up front rather than after the work is complete, you've paid for it and you have no access.