I've seen lots of places that think they have a process in place that prevents this. I've very rarely seen places that actually had sufficient security in place to prevent someone with malicious intent from actually finding ways of bypassing it if they were prepared to break company policies and/or the law. I'm sure they exist, and more places ought to take this seriously, but part of the problem is a lot of places think they have processes in place that ensures they're not vulnerable.

Often it boils down to not taking sufficient measures against social engineering. In this case the claim is they used fake usernames - most places I've worked, successfully getting a fake account if you already work there would tend to "only" require a willingness to lie on a form or two ("fake" a contractor) and then request elevated privileges. Very few places I've done work requires sufficient checks or counter-signatures to require additional accomplices or make it harder than that. They do exist, but they're rare.

The state of security most places is quite depressing at times. Then again, most of the time it's enough.