There is no enforced limit to the number of users.  In the documentation, we were providing an estimate to the number of users that we thought the system could handle when runing SQL Server 2005 Express.  This free database from Microsoft is limited to 1 CPU, 1G RAM and 4G database, so it is not the best database if you are expecting a heavy load.  You can find more information about SQL Server here: http://www.microsoft.com/sql/prodinfo/overview/whats-new-in-sqlserver2005.mspx

If you are expecting over 100 users, we encourage you to obtain SQL Server 2005 Workgroup or Standard.  This is not a requirement, but simply our recommendation.

We always recommend that SQL  Server be placed on a separate box, but the primary reasons are security and maintenance.  Where as the web server should be patched and updated any time Microsoft releases a bug fix, the SQL box should only be updated when absolutely necessary.  Although Microsoft will disagree with this approach, there have been way too many times when a Microsoft update failed in the middle of the night and required some manual operator action.  Web servers must be updated otherwise you risk a hacker attach, but the SQL box is usually behind a firewall, so updates become optional.  Again, this is just our opinion.

As for the 1000 users, I would not expect any performance problems from a 64-bit quad-core machine.  The one thing I would do is use two web servers behind a hardware load balancer (I'm not a fan of Microsoft's build-in load balancer).