This is not limited to an employee at OPs organization. It can be an employee from the corporation he is doing business with. Alternatively, someone could have printed an old email and one of the facilities providers (i.e. cleaning crew) found it and used it.