Some experts in email security said publicly available email exchange records indicate the campaign staff’s email accounts weren’t well protected. As one indicator, it had not enabled a common system called DMARC, which would confirm that an email sender from a Trump address was actually part of the campaign.

So they didn’t use basic security measures to keep their systems safe and (at least) one of the users fell for a spear phishing attack. Color me surprised.