[matwood]

Part of it is for security and the other part is traceability. You ask a bunch of questions pertaining to traceability that are now hard to answer because she was conducting business over a personal email server. Most private companies also forbid this for legal reasons.

The problem with classified or even just sensitive information is that it is hard to know what is what. For example a list of naval ship names is likely not sensitive information. That same list with some grouping may suddenly be sensitive. For this reason, it is good to assume all government communications someone at that level is having are at a minimum sensitive and should always be on government property.