Most vulnerabilites are found by discovering a new way of thinking about a problem. Once the new thought methodology is well understood, entire source trees can be searched for implementation faults. If the daemon gets more than 1024 characters, it starts overwriting the stack. Stack overwriting is a bad thing which allows remote users to insert arbitrary code to be executed.
Programmers tend to repeat their mistakes.
Most likely this is due to a lack of education. Here are some documents which discuss intrusion techniques, things to look for, and things to watch out for. Security FAQ Dan Farmer and Wietse Venema's Improving the Security of Your Site by Breaking Into it paper. En Garde's Historic bug tutorial Click here to go back to the Intrusion page.