I also don't think the openness on the calendar is the issue, more the stalking part. Just like how seeing where people go on the streets is natural, but sneaking behind someone everyday up to their house becomes something else altogether.
I would associate that with an email account that wasn't the work account, a printed page that was taken off-premises, a non-work cloud-hosted storage service, or to a computer that wasn't a work computer. It does not say that the place the information was sent to was any third party.
It could turn out that the information was sent to a third party, but that has not (yet) been claimed.