For Windows 2003 and later, the ssh-host-config script suggests using a service account, so that correct privileges can be set (because the built-in SYSTEM account has had certain powers removed in W2003).
However, the cygwin team has developed another strategy, which I have had good luck with (on Windows 7 and Server 2008 R2, anyway). If you use the cyglsa-config script to set up the cygwin LSA authentication package, you can switch the SSHD service back to using the System account, and no password would be necessary (and the ssh server works better, too).
The cygwin announcement and description of this feature as at http://cygwin.com/ml/cygwin-developers/2006-11/msg00000.html
For more gory details, see http://cygwin.com/cygwin-ug-net/ntsec.html#ntsec-nopasswd2