Looking at the notable claiming that the Chinese hacked the server to automatically copy any email means SR didn't necessarily have to leak anything. It also means the theory that the leak had to have been an on site job because of data transfer rates is not necessarily applicable because the leaked info wasn't necessarily downloaded all at once.
It could mean that what (if at all) was downloaded on site onto a USB drive was for evidence that that copied emails originated came from that server, IOW, USB downloader was a good guy plant.
Easiest way to copy all emails is to set up an automatic forward, which adds the possibility that it was set up by the server tech on purpose. That raises questions of tech motives and who ordered it done.
Don't know if servers were Linux builds, but, if so, an rsync chon job is a quick and dirty way to get info off the machine in small bursts. All a hacker would need is access to the admin back end, if present. Wouldn't necessarily need a root on the box.