Hmm. Thanks for the heads up -- directory indexes are now disabled.
That said, I dove into the wp-admin code a bit and I now feel sick to my stomach. The database interaction code for comment moderation specifically is unbelievably terrible from a performance perspective.
For every comment in the moderation queue, when moderating the queue, WordPress does the following:
wp_set_comment_status(): 1 db query
wp_update_comment_count(): 2 db queries
get_comment: 1 db query
get_post: 1 db query
That's 5 queries for every single comment in the moderation queue, so 5N queries in total, including a COUNT(*) -- ouch, who missed that day in database class? This is embarrassing.
This should be done with a worst case scenario of N + 1 queries, and that's only without modifying how comment counts are stored. Realistically this should be reduced to 2 queries for any number of comments in the moderation queue (total, not per comment).