Is Microsoft is still releasing security bulletins for pre-SP1 Windows Server 2008 R2? My guess is no. The "service pack support end date" is listed as 4/9/2013. And a comparison of security bulletin articles before and after May 2013 show only Windows Server 2008 R2 SP1 after May, which suggests to me that security bulletins are no longer offered for pre-SP1.
But the admin thinks pre-SP1 is still eligible for security bulletins until the end of its Extended Support (January 2020), and this
article, http://support.microsoft.com/gp/lifean25, seems to support that interpretation.