If they really had access to credentials for multiple accounts, then I don't see why they could not +2 their own code commits. Provided the code still builds and passes basic functional tests, I doubt anyone would see this.

Could it be that folks started looking at code commits when vehicles started behaving badly?