Why are 'we' not deciding that now ? It is exactly what he was hired to do. It was the purpose of the investigation.
No, security or administrative sanctions are not imposed by the FBI, or any law enforcement agencies.
That's the responsibility of DIS (or DSS, or OPM, or whatever it's called now), who administrates security clearances. Security administrators at the violator's employer would make the initial call, but it would ultimately be that government agency that revokes the clearance. And, they would refer potential criminal violations to the FBI.
Once the employee's clearance is terminated, it's up to the employer to decide what to do with them. They can't work on anything that requires a clearance. If it was something this careless, they would almost certainly be terminated with cause.