There's ... no downloading involved. He had the various binaries on his public home space, probably mounted to every machine via NFS, under his own name - and

There's ... no downloading involved. He had the various binaries on his public home space, probably mounted to every machine via NFS, under his own name - and this was inside a company, so it would be his co-workers potentially using it. That's quite a few degrees of separation from anything like a phishing attempt.