The security blunders are obviously horrible, but MAYBE explained by inexperienced developers tasked with something way beyond their understanding. But how on earth did anyone approve storing confidential customer documents in an email account? This seems to indicate there's nobody in charge that understands anything about how to run this business. And if it's a subsidiary or outsourcing partner, it also shows that n…
> But how on earth did anyone approve storing confidential customer documents in an email account?
Given the competence shown here, I doubt anyone approved anything. Most likely saving sent mail was a feature of whatever mail server they're using and it was a byproduct of the dumb decision to use an actual account for a "noreply" address.