I have a hub, with some computers plugged into it, and a cable modem. All of the computers except one have statically-configured addresses. The remaining computer runs a DHCP client, to get an IP address from the cable modem. It routes and NATs for the other boxes.
The router also runs a DHCP server, which I cannot disable. Is there any way that DHCP requests from the internet could reach it, affecting other customers of my ISP?
Not unless your ISP are clueless, DHCP is a L2 protocol that is usually segment-bound, your router would have to be configured as a DHCP-helper to pass client request onto the ISP's DHCP servers for you to be compromised.
Yes, if your cable modem is plugged directly into your hub it's theoretically possible for other customers' DHCP requests to reach your server and for it to respond, since cable modems typically bridge, making it one big broadcast domain. (It's also possible your cable modem has a built-in router, which would make the answer no).
However, ISPs usually implement filtering so this can't happen, since it would allow one customer to see all of another customer's traffic, which is pretty bad security-wise.