The other possibility is that they wanted her gone. So they had the inappropriate access done by her, with her user ID, so that they could follow the law and fire her for breaking the law. And it covers their butts, saying they fired the inappropriate data accessor.