I think someone at the org needs to be responsible for not ensuring former employees' access is not revoked, but that doesn't mean an employee who takes advantage of that lapse isn't responsible for his/her actions.

Put another way, someone at Verelox screwed up and left the door unlocked, but that doesn't mean that the person who walked in broke stuff is in the clear.

Look, someone, without authorization, accessed a former employer's network and maliciously destroyed data. That's a crime. Sure, the CFAA is overly broad and is abused, but this is not one of those cases: this is a textbook example of something that should be prosecuted under the CFAA.