I have excel files A and B. File A is linked to File B. A acts like input & output file, but A needs to pull data from B during the update.

I sent file A by email to a colleague without file B as B has confidential data in it, and I was expecting file A couldn't be updated without B. However, it seems my colleague can open file A in outlook and have it updated as if file B is still a valid link.

On the other hand, if he saves file A into his network folders, Excel shows there is a broken link, and file A can't be updated without file B.

I checked the linked source while opening in outlook, and it seems file B is saved in "C:\Users\XXXX\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.Outlook", but it is invisible to typical users unless you do some configuration.

It is a surprise. How would this be possible? Any insights with this?