osql.exe

Question

hi frindes .
i read a article about sql injection and hack.this article telled offen servers that we use for our website,that servers have sa user that maybe have null password.and hackers can attcke to your database with osql.exe command. i check 3 servers that i have database on it and there is sa user in security| login part that i can't change password or delete it.
my question how hackers use sa user ,and how can i change password of it?