I work in a high security industry. You’d be amazed at what you can do if you are willing to ignore the process. Our real defense against insider threats is attribution, law enforcement, and incident recovery. By the sounds of it, that is exactly what happened.