EPCC leaves 1,000 personal student files "exposed"