So some such system detected him as a threat and he left in under a month of employment? That's wild.
The FBI got lucky that one of their honeypot email addresses was the inbox. And then obtained records corroborating everything, such as from Kraken.
and the access logs of the top secret material from the agency's systems.
The access logs said Dalke accessed. Kraken's logs said "there were deposits of Monero in Dalke's accounts that are the exact amounts you sent Dalke, accounting for exchange rate fluctuations". Kraken's KYC records said "here's Dalke and his addresses". The UPS store he was using for an address said "Yep, Dalke keeps a drop here". The bank account connected to Kraken said "Yep, its Dalke". The setup at Union Station in Denver was for Dalke to come there between 11:30am and 3:30pm on September 28th, the affidavit ends 1 day before that, and Dalke was arrested in that exact location the next day.
he would have been emailing anyone and the compromised wires picked it up for the FBI to then begin their sting operation?
The FBI still had to do the work, but I think its also plausible that they have a bunch of honeypot email inboxes around. I think since they had to do all the communication as well as the transferring of funds that it's not really parallel construction, at least in any controversial way for evidence collection. They got additional evidence that doesn't need creating a rationale retroactively.
but what do you think happened here?
I don’t see the issue with this one to apply such a rigid stance
Maybe he did dumb things with it, but the whole thing was a sting.