Similar situation - True Story
When I first started working for "A Very Big Company" - this is the days before the internet - the "perk" was a company car, which everyone in the service department had, but since it was a "company car" and we were just workers any of the bosses could requisition our cars if their car was in the shop.
The Sales Director took my mates car one day (his was in the shop and he and his secretary had to go to a meeting in London) - he returned it the next day, but there were two small holes in the ceiling liner, aligned with the imprint of a pair of shoes, one on either side of the ceiling above the rear doors.
We all had a good giggle about it but there was no other evidence and if we'd said anything, we would have got the blame. And, whatever the evidence might suggest, there was no way to actually KNOW what happened - as in this article, you can guess what may have happened but you can't know, and I think most of us here realize how easy it would be to spoof a similar email complete with matching headers and log entries.