not altogether true
it seems there were several people involveld:
it started with a woman (working at the ministry) using her husband's still valid login (as he was working for the gpd).
he later started working for the ministry in question and both he and his wife started using a third person's login, possibly without that person knowing.
so no, it isn't just crappy security on the gpd's side.