If your CouchDB was open to the world, then that's definitely a configuration problem.

Sure, earlier versions shipped with "admin party" enabled by default but the docs made it very clear to not do that in public.