Penalties Clinton could face if indicted over private server