I guess one is left to wonder if "27 Hosted Exchange customers’ emails", means 27 email accounts....or 27 customers, some of which had thousands of email accounts.

It seems slapping a regex filter in front of an insecure public facing request processing service might be a sloppy excuse for a fix on Microsoft's part, as this simply side-stepped their fix from a couple months prior.