You are right, with M$ OS, server and workstation, you need a product id to install.
They could've used a license from their TechNet subscription, which would not be allowed in a production machine, whether you're nonprofit or for profit.
I recommend using the Magical Jellybean Keyfinder to record the Product ID used. Then check with Microsoft to see whether that is a valid ID and what kind of license it uses.
And then talk with the company who built the box for you, asking them to check their records for that Product ID.