They didn’t need be “given access”. They need only know that the server _existed_, at which point suitable talent could be hired to acquire the contents while she maintained plausible deniability. A wink-and-nod is enough to assure donations and speaking gigs would occur, involving lots of digits.
Note the language used by the geek “no unauthorized access” was found. That to me means there was authorized access. It could be in the manner you speak of but knowing the greed I would assume it would not be available unless the cash was delivered.