The answer is misconfiguration. There are three primary ways these files end up exposed:
This search operator tries to find Excel .xls files that have “email” in the URL/filename (e.g., emails.xls , email_list.xls ) and are publicly accessible on websites. filetype xls inurl email.xls