Tormail consisted of two servers. One was an anonymously rented VPS that communicated directly over clearnet. It hosted the tormail.org/net web site and accepted emails from other clearnet email accounts that were addressed to @tormail.org/net. The other server was the hidden service that you connected to when you checked your email. The clearnet server was a proxy to the hidden service and didn't store emails. The hidden service stored the emails. The problem is that the hidden service turned out to be the Freedom Hosting server, which was seized by LE, so they got the server with the emails.