There is proof that his password was password, and there is proof that his IT told him the phishing email was legit. There is no way that same IT was capable of securing a mail server for HRC.