If your site is found on Mapdex, then it is publicly available.  It may have not been advertised or it is not supposed to be publicly available, but if I found it (via simple Google or Yahoo searches) it is out for anybody to use/discover.  The way to keep people like me (or the Navy) out of your site is to enable authentication on your ArcIMS server (or keep your site behind a firewall).  This is similar to the setting that keeps search engines from crawling files (robots.txt) on your web server.

Here is an article by ESRI on enabling ArcIMS authentication.

Authentication can be set for specific map services or for the entire server.  We do a mix at our organization.

If you have questions/concerns please send me an email.

For those keeping score....around 20 organizations have asked to have their server added and two have asked to be removed. 

Jeremy