Could it just be something as simple as this ex-employee was some sort of admin, so he knew others passwords, and now is using someone elses username and password... ?

Or maybe he added his "home" email to one of the mailing lists?