I think you may be confused. The private server she used while at the state department was not hacked, at least as far as anyone knows.

The point here is that they started to attempt to spearphish campaign servers on July 27.

Second, I don't know how you might define a "shitty" server, but the whole point of spearphishing is that it works around the server-side security. You could spearphish a Gmail account just as easily as a 10-year-old unpatched Linux box. In fact most of these, including Podesta's, were Gmail accounts.