Fined $4m for Who-Me-esque mess, for which it blames unnamed archiving vendor’s retention settings