I assume there is no evidence except an account full of pictures of the guy?

Maybe the employee claim is wrong, who knows, but determining who owns the account should be trivial. And frankly, given what we know about how the Twitter "hack" went down (rate limits? sign offs? resetting 2FA? impersonating accounts?!) it is fully believable.