* User has an important problem * Central IT will not oblige for whatever good or bad reason * User is both required and forbidden to resolve the problem, decides Central IT can stuff it, and writes a powerfull excel macro. * Other have the same pain, so User's macro gets copied, cloned, weirdly mutated etc... * At some point data has to be exchanged with another company, so they semi accidentally get the macro too. This introduces a required potentially malicious email atachment. * In all of this, everybody conspires to get Central IT out of it, as they will stop the macro and cause much pain and delay for everyone involved. In a lot of cases, Central IT does its utmost best to not officially notice the macro.
This is generally good, as it allows big corporations to survive, even in spite of Central IT. But it also means things like this attack easily happen.
Almost every organisation with more than about 150 people will over time devolve to some kind of soviet state with all kinds of institutionalized insanity. As long as humanity has not solved that sociological problem, this attack is the kind of fallout to expect.