If he was part of the SA team for their production systems, it's likely he DID have root access to all of them, and that it was legitimate and had business just

If he was part of the SA team for their production systems, it's likely he DID have root access to all of them, and that it was legitimate and had business justification. Even if he didn't have explicit root access, it's even more likely he had direct physical access, which is generally less carefully protected by IT policies and is usually all or nothing. Granted, this isn't just run of the mill data, and Fannie Mae could have certainly had significantly better security policies in force, but I don't think they were below average for a corporation in their security policies.