Actually the location of the system.mdw file is not the issue. The location of the default workgroup file is stored in the registry. Its also that they were starting up the database via a shortcut that told Access which .mdw file to use for validation.
A shortcut with something like the following in the 'target' box:
"C:\Program Files\Microsoft Office\OFFICE11\MSACCESS.EXE" /wrkgrp D:\Application\CustomWorkgroupFile.MDW
You can try a couple of things.
There is "break-in" code laying around that exploits the fact that when we were taught to "create the bypasskey property" most were taught:
Set prpAllowBypassKey = db.CreateProperty("AllowBypassKey", dbBoolean, True)
which would leave your database vulnerable to 'getting around the bypasskey' on startup.
The new 'correct' way is:
Set prpAllowBypassKey = db.CreateProperty("AllowBypassKey", dbBoolean, False, True)
Also, there are password crackers out there who will crack the .mdw file for you for a reasonable amount of money (see the web).
Hope this helps.
Rob