But if it's run from the ground up by the community, who has the root password to the server? Who has a contract with the company that hosts the site?

I'm not sure I understand, but anyway I'm skeptical about the whole "team" idea, as then the team becomes an internet community unto itself, and might tend to shift the focus away from the wider userbase and toward itself.