You are exactly right. Those systems are closed loop for a reason. The store/forward in this specific case was most likely a human, with a scanner or just retyping documents from those networks on to a unclass network and then sending to the private address. How that is not deliberate we will never know.