Something perhaps relevant, small companies tend to have a small admin function, who use the same password for everything. Not everyone in the world knows much

Something perhaps relevant, small companies tend to have a small admin function, who use the same password for everything. Not everyone in the world knows much to change their password, especially if they're using a desktop client such as Outlook. It just connects. So it is possible that everyone in the company was logging in with the same password as the exposed email.