A lot could be recovered, All "rm -rf /" does is remove the directory (folder) entries, the files themselves remain on the disk. There are programs that read the raw disk and recover what they can. I would pull the power cord out to prevent any over-writing on shutdown then reboot from a "live" recovery disk or memory-stick, Knoppix for example. Needs physical access obviously, or a fast phone call to the actual hosting data-centre.
Same applies to hosed Microsoft systems with disk problems, I have rescued a few for friends also using Knoppix for the rescue. Then just find out where the bad sectors are on the disk, move the partition boundaries to avoid them and return to service (with a bit less disk space available). This trick won't work with SSDs unfortunately.
However a thought occurs, to remove everything as described "root" (administrator) permission is needed, what was the guy doing running a bash shell as root on a server? As is so common there may be more to this than was reported.
'a