Re: Something else is happening here
"Every field has its share of people who are disturbed, distraught, or jut plain jerls, including IT. In this instance, if it wasn't the leaving sysadmins, it was someone else with the access and the knowledge of what was valuable."
This, combined with the access they have to potentially important systems is why it's important to do what they told us to do in my degree when firing contractors and sysadmins. Put simply, if you need to fire one, disable all his or her accounts, cancel his or her access cards (assuming your building uses them) and find a couple of burly security guards to escort them off the premises. All of which happened within 20 minutes of an ex-colleague at another company being fired, and the only reason it took 20 minutes was that his line manager needed to question him first.