How about setting up a firewall so that the workers can't initiate connections to other hosts (apart from the BitWrk service)?
That would be a good idea, but I've already made a bad setup. I'll try doing a quick setup and running it when I have more free time on my hands.