Why has no one pointed out, that when one obtains a security clearance and signs the form (which everybody has to do), the form says that you are REQUIRED to report any security violation of which you become aware? Consequences for not doing so could be almost as bad as the violations itself.
So, EVERYONE who knew of the server and even had the slightest inkling that it may have classified data, had a DUTY to report it. None of them did.