Well, given that they are morally corrupt enough to do this to their customers, why not expect them to have similar trojans or backdoors on Thinkpads?

If we assume firmware is safe, wipe it and do a clean install from trusted media.

Because the business and consumer teams at Lenovo are largely separate. I can't order a Yoga through my Thinkpad rep. I have to go to a retail vendor and us a credit card. I expect there are lots of people at the old IBM offices in New York who are as horrified as we are at when the consumer team agreed to.

Can we assume their firmware is safe though?

No. Firmware has been a part of the "trusting trust" conundrum for several years now.

Thinkpad T430s. It's a year old so I'm in the clear upon more detailed reading of the article. I usually do a clean install but when I bought this box it came installed with Win 7 and the discs I got were Win 8 only. Didn't come with a Win 7 serial. This is what I get for buying from a reseller on Amazon.

T430s user here - you should be proud. Did you know Coreboot started supporting T430s a week back [1] ?

[1] http://www.phoronix.com/scan.php?page=news_item&px=Coreboot-...

If you have Windows installed I think you can extract the license key from it (assuming Windows is genuine), then use it to do a clean install, or just save it for posterity in case the hard disk ever dies. As far as I know this is fine WRT Windows EULA.

no you cant - not in lenovo's case. The reason for this is that the keys for lenovo correspond to a very special Windows release that Microsoft specially bakes for Lenovo. You cannot use the keys on any other ISO. This is also a big problem - you cant download these ISOs (unless some *rrentbay) and Lenovo does not give you CDs readily.