Yeah, the issue is a lot more ambiguous than my comment let on. If I had to make a determination, I would say any specialized technical knowledge or extra effort to access the resource would fall under the CFAA. So knowing of a default guest account that wasn't pointed out to you by staff, or finding the boss' password on a post-it note and entering it would count. Being given a superuser account is even greyer. Perhaps if you come across sensitive data in the natural course of your work, then you would be safe from this law. If you recognized your elevated privileges and then went out of your way to find sensitive information, then that should be a violation.