Yes...
http://dtic.mil/whs/directives/corres/pdf/510521m_vol1.pdf
DoDM 5105.21-V1, October 19, 2012
Enclosure 5, 1-b.
It's worth noting that DoD Manuals are all restating of parts of USC. Although I am posting the DOD reg, the same information applies to all agencies and is in their manuals almost word for word. I just failed to find the source reg in all the garbage google throws out.
Yes, but they won't be able to because SoS has the ability to declassify anything unilaterally, just as the Joint Chiefs can declassify any mil documents. All she has to do is make a memo declassifying that material "appear" with a date prior to the emails. There's not even a form, it's just a memo at that level. I'm pretty sure that she took an electronic copy of her letterhead home with her and has a friendly person in the administration to "find" it...
For us Joes, if we notice it, we report it to the SSO and the command makes a determination on whether the leaker keeps his clearance. Either way a 15-6 happens and the IASO is charged with trying to contain the damage and assess the risk of spread of the leak. Been there done that, someone went cross-domain while I was IASO in a contingency area. I had to provide the audit trail for the investigation showing the access and the media used to go cross domain after cleaning up the mess. There was more, but not for a forum. Let's just say it was a giant PITA.