Just present it as you would any vulnerability you'd found:
Overview of access gained
Detailed info of how you got in (discovered username in public domain, had weak password set to service x)
Suggest how you would remediate this issue (strong passwords, advise not using internal email addresses or usernames anywhere outside the corporate network etc.).
As a red team leader, have you not come across this before?
Edit: You could also specify the two items separately first: "Usernames discovered on public sites", then "Weak password set on user accounts" then combine them to present how they were used to get access to a given service.
Overview of access gained
Detailed info of how you got in (discovered username in public domain, had weak password set to service x)
Suggest how you would remediate this issue (strong passwords, advise not using internal email addresses or usernames anywhere outside the corporate network etc.).
As a red team leader, have you not come across this before?
Edit: You could also specify the two items separately first: "Usernames discovered on public sites", then "Weak password set on user accounts" then combine them to present how they were used to get access to a given service.