It wouldn't be one machine. The initial incursion would have been used to leverage other local attacks. Then targeting domain controllers and admin accounts.

Probably also reading email; one possible way of finding it needed to get at 5 of 9 keys to unlock.