[grandalf]

Wasn't the server in question unpatched for quite some time, meaning that any number of adversaries might have hacked it while it was vulnerable?

Chances are at least a half dozen state actors and another half dozen private entities would have had a strong chance of being privy to the exploits used to hack the server and would likely have been on the ball enough to do so when it was vulnerable.

In any case, the "who exploited the vulnerable server?" question is less relevant to American democracy than digging into the questionable conduct revealed by the emails.