No doubt the statute of limitations applies to many current and former State Department officials, including Colin Powell. In any case, one has to look at aggravating factors, which in Hillary Clinton's case are present. The fact that she set up a private server, and archived documents there which were available nowhere else at State is a huge aggravating factor. Hillary's defenders will argue of course that a regular State Department email account would also have been unsecured and inappropriate for classified information. However, an official State Department account would have been available for monitoring by various people at State. It is not only much more likely that classified material would have been discovered on an official account (it was impossible of course to discover it on Hillary's private server since nobody else had access to it, except maybe the Russians and Chinese) and thereby removed, but also any security breaches due to outside hacking were more likely to be discovered.
Remember, it's bad enough to have classified information fall into the hands of our enemies. But it's much worse for it to happen and got our government not to know about it for many years. That second problem is definitely on Hillary, and it wasn't an accident either.