the minimum requirements are a combination of our usage and our testing setups. Sometimes when we change pre-requisites we dont use much of the new capabilities initially to allow a "soft-landing" for a few versions, though this tends to be on the database side and not the framework side (e.g. we are unlikely to have any sql that requires sql 2008 at the minute but probably will in the next few versions -however we already have plenty of code that requires .net 4.0).

In this case the server is probably not as critical as it was probably moved as windows 2003 is no longer in mainstream support from Microsoft, and it reduces our testing matrix. As such you're probably "safe" to stick with it for a while, but I'd recommend considering moving to a support operating system when you can (also from a security perspective there is are known security bugs such as http://secunia.com/advisories/37831/ that microsoft will not be fixing in IIS6 -note: we have code in DotNetNuke to handle this edge case but its rare that we add code to work around unsupported OS's)