I think the thing that doesn't sit right about this is that he accessed the data with entirely ordinary means, but it's called "access without authorization" si

I think the thing that doesn't sit right about this is that he accessed the data with entirely ordinary means, but it's called "access without authorization" simply because the company didn't want him to have it. If a company accidentally puts a link on their homepage to private info (say, with a typo) and users click on the link and read the page contents, are the then violating the CFAA because they should have known that the company didn't intend for them to view that information? If you get naked in front of a window visible from the street, you can't get mad that someone saw you.