It's totally legitimate to simultaneously hold that the real perpetrator is, er, the perpetrator, and that the victim could have done more to prevent the incident from happening.

Jail the guy, and let his story stand as a warning to implement proper IT and HR practices.