Don't know 2003/IIS6, but Apache (avail for windows) and other servers have config options by which you can restrict the scope of any user's cgi-bin user program; which let you restrict where cgi-bin is allowed, etc.

If you have a 'druthers (choice), you're at a stage where investigating alternate servers might be valuable. If the prospective accounts don't need some MS-specific capability, you may have options.

updatedFirst para changed for clarity