I believe you are correct. The monitoring of company equipment detected the exfiltration from Google. Metadata from this could have been used to pinpoint the da

I believe you are correct. The monitoring of company equipment detected the exfiltration from Google. Metadata from this could have been used to pinpoint the data flow on personal equipment, but it sounds like this document was prepared on the non-Google side.