A lot of people like to throw out the espionage act but one of the key components is that there must be intent.
Not according to (f). Intent is covered elsewhere in that section, but none is required in this part. The other sections deal with willful acts, but "gross negligence" does not mean intent to divulge. Instead it's exercising due diligence.
Let's take me as a pharmacist. If I willingly harm someone then I am liable for the consequences. If however I do not intend to cause harm, but because of disregard for my duty I am negligent I am still liable. Holding a legally established position (and one cannot be a pharmacist without government permission through licensure), I have an inherent responsibility which cannot be put aside. Lack of intent to harm is not a proof against prosecution.
Whether the Act as it stands is in need of reform I'll not debate, but it is there , and like myself ignorance isn't an excuse that will hold up in court. Note at no time have I suggested even hypothetically that Hillary with intent and malice divulged state secrets. There's no rational reason to believe it based on her history and I dismiss it out of hand.
Again, this is about what could go wrong, not saying "Hillary was hacked!" All that remains to be seen, and like Bush I wouldn't want to see her head in a noose unless there was demonstrated violations of law. Her fitness to serve is a matter for debate. Punishment when there is no wrongdoing is not.