Nothing is 100% secure on the internet, I've learned that working with the local NSA Cyber Defence team. :) To put it straight: OFC someone can.
Option 1: The email got caught
In this scenario, simply one of the many gateways got interfered and told to send a copy of your email to the possible attacker.
Option 2; Your server is insecure
This is simple. Your server got penetrated and somebody simply sendin all the email to himself as well. I would check maillog, secure log, messages log from the time when a possibly "hacked" email was sent. Also enhance your security. If you do not use SMTP, you only use sendmail, then hide every IP you have open and make special firewall rules. Also use fail2ban to kick off all the SSH attacker. Use SSH-Key pairs to access your server, etc.... ok, I'll stop here otherwise I'll have to send you the bill. :D
Option 3; The client mailbox is hacked
This is, in my mind, the most obvious. The clients mailbox, who you send your sensitive data to, got hacked and simply somebody else can read all the messages. Change password, use 2 step verification, etc, and see if your information is still getting leaked out.
Bonus: Use encrypted emails
You can always use encrypted emails, however I don't know how to use that with sendmail. For Thunderbird and a dozen of android apps there is a plugin that uses https://www.openpgp.org/ and you can encrypt your email and the receiver can only read it if he has the other pair of your encryption key. Otherwise, even if an attacked hijacks your email and reads it, all he could see is random bullsh*t and good luck decrypting that.