It’d either Carlos (bored to tears there) was pulling off all email to this server; she may not have known. Or, purposely placed there for the right people to ‘hack’ for a fee.
She will say he stole them. Not her fault.
There is no reason to give either of them the benefit of the doubt.
Both are compromised beyond belief.