Volunteer-run tech and IT for non-profits aren't exactly well known for the highest of standards of engineering. The likelihood of someone accidentally leaking AWS creds or other PII seems reasonably possible without well established engineering practices.
Alternatively, it may involve proprietary code for a software vendor they work with that they don't have the rights to redistribute.