There are a few places it can get in but commonly the caulking between roof and rest of the body (ie in the roof channel) degrades with age and very fine cracks appear. You can use clear silicon to fix that. As for plenum water should never get in provided the drains are working (and the drain voids are large. While the plenum is off you might like to do what I did which was to add some stainless mesh (fairly small voids of about 5 to 6mm) and wrap it around the raised air intake and use pinched grip and silicon to keep it in place. Very neat and stops rats and leaves entering your fan space. Cheers
