Asp Old Man....

You're thinking a little too deeply maybe....

It really doesn't matter why X wouldn't give Z his password. It matters somewhat that Z tried to socially engineer your system and that X abetted in that act but you are trotting off down a series of complex and time consuming "alleyways" when the answer may quite well be relatively simple.

If you are a Windows domain you can create OU's for the different locations and delegate a person in each location as a "local admin" - (They only have admin rights in their own OU). Then, if a user needs this kind of thing in the future they simply go to the delegate and request permission be granted to that file or that the file be moved/copied to an accessible location. The delegate can also reset passwords etc. if necessary.

Does that work? Small amount of training and you have beaten this issue...