Maggie's Farm

The answer to that question should be everybody. I've been a server administrator, among many other things, in an IT career of over 25 years. There is a procedure for decommissioning a server.
Normally, when you delete a file from a computer, you do not actually remove the contents from the disk medium. What you actually do is delete the entry in a table (gets a bit more complicated in advanced file systems, but general principles apply) that stores the file name, the directory it's located in, and the physical locations on the disk where the file is stored. It's a surprisingly trivial task to run a special program that sweeps the disk medium then locates and catalogs the deleted files.
When decommissioning a server, the accepted practice is to delete the files, and then run what is referred to as a multi-pass DoD wipe. A low-level program runs outside the operating system and overwrites the entirety of the disk medium with a series of patterns designed to obliterate and/or obscure any residual file information on the media. If the server has an array of disks, even better practice is to then remove the individual disks, re-arrange them in a new array, and repeat the process.

If the information held was particularly sensitive, it is best to destroy the physical integrity of the disks, usually by drilling through the outer case and the disk platters themselves.

This still does not remove the information from any backup media, and often times these cannot be destroyed as the system was backed up as a part of a group of servers. In this case, it is vital that the backup media be subject to physical security and off-site retention, and that a chain of custody of all such media (tape, solid-state, or disk) be maintained.

It's that last part, the physical integrity of the servers and backup media that was likely lacking in the converted apartment where the server was located.