People still get "compensated" for reporting to the authorities a sighting of a [wanted] criminal, so long that it leads to the capture of said criminal. This could be a similar case. If the device was turned in for a hard drive migration, for instance, and the employees stumbled upon this nightmarish content, I see nothing wrong with them (the employees) reporting it to the authorities. As a result, the authorities could have paid them [individually] a bounty.