It sounds like he had a lot more than just root access...or just knew where to look.
just getting to the database would be enuf.. obviously new safeguards are in order.