[Wolfstar]

The only way I can interpret it is that: (1) Berger went back more than once and took documents on more than one occasion. (2) They marked documents as a means to prove beyond doubt who was stealing them. In other words, the marked documents were part of a sting operation.

[LTCJ]

If they suspected documents were missing the SOP would be to immediately audit the collection after each access. (That is not necessarily trivial, depending on the size of the archive in question.) If he had stolen documents more that twice, they'd have him without the need for special markings. Again, the only reason to "specifically mark" already catalogued and indexed documents is if they suspected documents being replaced after improper editting.

There are specific procedures followed to change classified documents. You don't just take out an eraser or substitute a page in an already logged document. Any such change in itself would be enough to send him to the big house.