Did the director have his email on a vulnerable server? Yes. Yes he did.

He should have known better.