It's always been my contention that HRC's bathroom server was unsecured because it was the drop-box.
Just like the old trashcan by a national monument in the old cold war days, HRC left information that she sold on her server and let "donors" to her "foundation" hack the unsecured server and get the info. The info was placed on the server once payment was received.
This system would give her plausible deniability โฆ "My server was hacked! I didn't sell classified info."