If I leave a pie on the windowsill, it is still wrong to take it even if it’s easy.

Bad security practices doesn’t mean it is open season for any activity. Being fired and logging back on to work computers is really hard to defend as not knowingly wrong.

This is fine, I will copy your pie instead. No harm done then, right?

I’d download a pie.

That's not what the parent is asking tho. They're saying how do you actually pin it on them.

You ask the ISP who owns the IP who was using it at a specific time, when it turns out to be your former employee’s home, you ask for a search warrant to sieze her computers as evidence. Then you try to match logs on a device with logs on your servers, and additional evidence perhaps as well in order to establish beyond reasonable doubt that this woman did indeed do what is being accused.

Yes because ip spoofing doesn't happen.

So your conspiracy theory is someone sent the message and spoofed Jone’s IP address in order to frame her? Give me a break.

In any case, the right response is to serve a warrant and check her devices to see if there’s substantiating evidence.

It wasn’t any random IP. It was her IP.