When installing web deploy DO NOT install the Remote Agent Service!

If you do, it will listen unsecured on public port 80 on the server, locked down only by username/password.

 

It listens at:

http://<site>/MsDeployAgentService

If it is running you can browse to that URL and it will ask for username/password. If this happens you should do a Change install and remove the remote agent service, or disable it!