Stuff like this does happen at the big companies, but it's also rooted out (when you're that big, you can afford to have internal security teams that investigate this stuff) and the offenders get fucked by legal (and fired, obviously). Usually quietly because of the PR damage it would otherwise cause.