At Facebook, you could alter code even after somebody had given the OK for code review. I know some people specifically kept some small commits open after being approved, just so they could quickly make changes without needing approval if they ever needed to.

At Google you can mark something as TBR (to be reviewed), as long as you're one of the designated owners for that code.

“Dear respected members of Congress, ...”

I guess my thinking is if the disgruntled employee was so upset over not getting a promotion to cause so much damage they must have been in a high enough position already to warrant such a disposition, and "high enough" might mean high enough to have push access themselves.

Edit: see closeparens comment above. Complicated systems can always be subverted when trust is broken.