Couldn’t they’ve said they didn’t have the key anymore? Or automatically delete emails after two years or so?

Seems reckless to keep confidential information like that, but I’m not familiar with the legal obligations large companies have, of course.