What we know so far:

1) Communications with her server were not encrypted for the first 3 months.
https://www.venafi.com/blog/post/what-venafi-trustnet-tells-us-about-the-clinton-email-server/

2) They left the default VPN keys installed on her server
http://www.bloomberg.com/news/articles/2015-03-04/clinton-s-e-mail-system-built-for-privacy-though-not-security



3) They were using, and continue to use, self-signed SSL certificates
http://gawker.com/how-unsafe-was-hillary-clintons-secret-staff-email-syst-1689393042

4) They set up a .com domain, enabling the typosquater who has registered clintonmail.com (no "e" before "mail". Whoever registered that domain is in a perfect position to steal login information or perform spear phishing attacks.

5) Her ISP was repeatedly hacked by China
http://www.democraticunderground.com/?com=view_post&forum=1251&pid=615632