Probably an old .mdb sitting thirty subfolders deep on the server. \\columbia\old\archive\archive_new\_REAL_ARCHIVE\pre2000\backup\ ...
Very possible. I worked at a place (now gone) where I discovered years prior the HR department had contracted some consulting company to build a basic HR system. The consulting company had hosted it unprotected on the open internet (you could connect to the mysql database from anywhere).
The system had long been abandoned (they migrated to Oracle's EBS HR module several years before this was discovered), but there was one piece that had never been migrated that HR continued to use (a story in of itself, a bit of automation using tcl(!)), and no one realized that database was still out there with everyone's SSN (among other things) that had worked there at the time the system had been used.
We very quickly get them to turn that off and destroy the database.
