Reading between the lines and with some very limited knowledge of airline IT and it being a mishmash mess of sticky plaster, to me it sounds like this is a service provider of a service provider, ie. one or more steps removed from BA's direct control. You could imagine that the service provider that BA is contracting with directly provides several services and one of these is in turn outsourced to the leaky third party. The benefit derived from the main contract outweighs the impact of the leak, and if the leak can be plugged and BA compensated it's one less thing to deal with changing.

Although with the relatively random performance of BA cancellation notifications you might have hoped it would have been an opportunity to fix it all properly. But is that the problem of the third party or the data BA expose to them?