Just a couple of things to add, from the perspective of a retired I.T. Consultant and Manager . . .
First, regarding the question of whether AP was likely ignorant of what happened, or whether they were "involved". In large I.T. environments, it is common (and required nowadays with SarbOx) to have a division of roles and responsiblities among I.T. personnel. However, in small shops (like Absolute), especially overseas, it is common to have the Fox guarding the hen house. In other words, you might ask your favorite software development programmer/analyst to act as your security officer too. So it is conceivable, in this case, that the "inside person(s)" may have been called upon by AP Management to look into the complaints and allegations that the company has been receiving. And of course, for a while, such person(s) may be capable of convincing Management that these allegations are baseless.
I realize that this is speculative. I only raise this point to illustrate that it is very possible that AP has in fact been truly ignorant of the actual events. Of course, even if they have been ignorant up to this point, I'm sure, with the pressure they are now experiencing, that they will begin looking beyond their own trusted personnel for answers here.
Second, for those digging into the technical aspects of how this could have been done, I just want to remind you that strictly speaking, a super-user capability may have been achieved with indirect (rather than direct) access to the "magic file" (that contains the hole card info).
1. The data could be sent directly from the program variables, before they have ever made it to a file.
2. If some form of journaling or redundancy is in place (logging all DB changes that have occured to the "magic file" for data recovery purposes), then that data could be tapped instead of the primary file.