learned that they had a system with local admin attached to the corporate network that somehow IT didn’t know about. They were using that to host their repos.

That’s called shadow IT and is a huge security risk.