Post scriptum: My Windows box got sick and my Mr. Fixit was just here to take it back to his workshop. I took the opportunity to show him a few things on the Mac and discuss general security. He was impressed inter alia by the SysPref screen, Command-Comma access to Prefs and by what I told him of the courtesy and helpfulness of the Forumites, but laughed his head off at the default firewall setting being "allow all incoming connections".

Trevor, he knows my ISP, so he could tell me my router is indeed a NAT and that it is supplied with the Remote Administration firmly off, so that's a good first line of defence, behind which I'm beefing up my second.