It was an exchange server, which is a bit irrelevant to its security, were it maintained correctly. One issue is that it wasn't just an Exchange server, it was

It was an exchange server, which is a bit irrelevant to its security, were it maintained correctly. One issue is that it wasn't just an Exchange server, it was a 2003 version of the software and seemingly didn't have very good security protocols surrounding it. On a side now, I despise that Gmail dropped ActiveSync support. Hooking up Outlook is a huge pain in the ass, and it's 100% intentional.