And that’s just scratching the surface. Yes this is a regulatory infraction. No the report cannot remotely be construed as “scathing” except to the extent it shows State seriously needs to update its IT infrastructure and apply to future SoS.
The real action, if there is any, will arise from the FBI investigation that is still underway, relating to actual classified material that was specifically excluded.
Also, add Colin Powell to the list of indictees, as he used personal email exclusively for years as Clinton’s predecessor in the SoS position.