What steps were taken to make sure that Stack Overflow doesn't get hacked to tears? What privileges does the SEDE SQL user account have?
Hacked to tears you say :)
All the queries are running under a read-only user which has no write rights anywhere on the DB. This user also does not have any 'EXECUTE' permissions anywhere on the DB including the famous
xp_cmdshell and so on.
Further more, all the data is hosted on dedicated hardware which in a separate data center to production, so runaway queries will only affect performance of other SEDE queries. To top that all query results are heavily cached.
Not only do these queries run on a copy of the data (released to the public every month), the prepared copy of this data dump is itself protected in that the user account used to run the queries only has read access to the data.
The queries against the data explorer works on a copy of the latest data dump, not on the live site. Also, I believe it's hosted separately from the actual Stack Overflow site.