Here's a thought. Why did she not post it on the way to work?
Someone at work may of given it to her and said, if you are passing a box can you drop this in? It may of been admin generated at work. I would guess she is on cctv at work, the police can perhaps see her talking to dear friend D.O.
I do not think doing your firm favours with all the protocols, policies and Data protection issues would mean that would be possible