How to find the place where the data is leaking?

Question

Information Security

Good afternoon. Applications to a competitor are leaking from the site. How applications get to the competitor I can not understand in any way. My question is very superficial, but there is no one else to consult with.
Now I will try to describe the chain along which applications go.

• WordPress site with SSL certificate. The forms on the site work through the Contact Form 7 plugin.
  
• When sending any form from the site, the application falls on one general mail. Several people from the call center have access to this shared mail.
  
• At the same time, when sending an application, data is sent to comagic. From comagic there is a quick chime on the sent phone.
  
• If a person did not answer the call, then his data from the application is entered into the SRM system. Almost all employees of the company already have access to this SRM to work with clients (about 100 employees).
  

Our new customers from applications report that our competitors start calling them after submitting an application through our website.
The files on the site were checked several times for sending data to other people's mailboxes and the suspicious code was removed.
I have the following questions:

1. How can I track at what stage the application goes to the side?
   
2. How can you increase the security of the entire system (from the site to employees)?
   
3. What should be paid attention to when looking for a security hole?
   

Answer 1

Let one day each of 100 employees see a work phone number that is not familiar to them. BUT! 100 variations of names and surnames - i.e. Show only one to each employee.
If this particular name leaks, he leaked it with 99% of the shares.

Answer 2

For starters, I would not rule out the human factor.

Answer 3

A bit of an obvious suggestion, but look at the Contact form - what mails does it send to. Once I fixed a similar bug, people had a problem - someone added an e-mail with a quiet glanders 2, and it was far below and it was not fate to scroll.
In addition, look at the site itself - perhaps a script has dug in somewhere and sends everything that is entered into the forms.

Answer 4

It is worth paying attention to Chrome / Firefox plugins, they come with vulnerabilities, steal form data.

Answer 5

Several people from the call center have access to this shared mail.

- You DO NOT have any protection against leaks. Or put up or each manager to sign a non-disclosure document with the threat of criminal liability.