A security audit identifies a number of large email messages being sent by a specific user
from their company email account to another address external to the company. These
messages were sent prior to a company data breach, which prompted the security audit. The
user was one of a few people who had access to the leaked data. Review of the suspect’s
emails show they consist mostly of pictures of the user at various locations during a recent
vacation. No suspicious activities from other users who have access to the data were
discovered. Which of the following is occurring?