If the user has Terminal Services login rights on the system (or if it's a domain account, any other systems on the domain), then an attacker can do whatever he likes to the servers as if he were logged in at the keyboard, up to the security cred limits of that account.
However, we've seen soooo many examples of unpatched services and apps, that resulted in elevated rights when attacked in specific ways (SQL injection, buffer overflows, you name it).
Each account on the system is a vulnerability, and as such, you should always be vigilant about how much access users have, how often they change passwords, how strong their passwords are, and how and to what they are allowed to log on. My policy is pretty simple "Give them what they need when they need it, and nothing else." If that means disabling accounts during non-work hours, or locking accounts while people are on vacation, or shutting off terminal access until someone says "I need to log into this system"... so be it.
I'd rather be hassled by legit requests than kept up at night by hacker issues.