I understand why the article is focusing on the "misconfiguration" but the real mistake here is asking for (and providing) sensitive data via email at all.