As I see it, it does not make sense.
He must be the culprit as "nobody else had the skills", say that he trespassed, yet provide no proof... looks sketchy.. IF he had a stolen laptop (good luck proving that) and that laptop was used to do the thing.. then maybe.
Now, why should the judge believe that the laptop was stolen? does he still have it and can the company prove that it belongs to them? after all they signed on it..
As for having a file with all the passwords, it makes absolute no sense, as that file can be transferred... and as for using the mac.. again, no sense, macs can be spoofed.