The box should immediately be seized by intelligence to see what backdoors have been placed on the server and who gets CC’d on her emails.
Way too late for that. If her Sysadmins have any brains, the server or servers were sanitized days ago when this story first broke.