Note that these are generalisations and are not always "bad" but thought should be given whenever you see them.
These are a few quick thoughts and will grow as I come across more.


Abundance of cursors.
No testing of backups.
Proliferation of dts packages.
"I have to use dts because it needs to be scheduled".
No release control.
No release history.
No integration of database partitioning with backup strategy.
A table per company/client.
Use of enterprise manager for data or schema updates.
A task to frequently shrink databases.
User connection as sa.
Dev databases using full recovery model.
Embedded sql in applications.
Stored procedures to access tables rather than business entities.
Application bound to the database structure (application should have no knowledge of tables).
SQL in client (see above).
Use of maintenance plans (sqlmaint.exe).
Updating primary keys.
"Business logic should all be contained in a middle tier written in an application (procedural) language".
Database access other than by stored procedures. Embedded sql in the client.