[erosenbe0]

I've see this without Gsuite vector. Could be employees logged in to personal device and leaking through those interactions. Or email to external investors, consultants, or contractors? Send something out to your external translation or localization team, ad agency, or copy editor? Difficult not to have some leakage.

[clnq]

All of these could be true. However, the start-up was using GSuite a lot. It constituted about 90% of the company's interactions with Google. It's impossible to certainly know what happened since Google can't be asked where it got its data.