Based on what we've got, it does look like we're looking at either an inside job or some really stupid internal IT policies.

Whoever did this had root. While it's obvious that internal information security is lax there, the reality is that it's a lot easier to get root by getting hired as the IT administrator and being given root as a part of your job. That's the ultimate social engineering stunt. There won't be any penetration logs, simply because the computer system wasn't hacked.