The way you described it, my first suspicion would be a fellow volunteer or employee accessed it, knowing nobody would find out for a long time.