Equally, what's to stop them being in the know of exactly what he's doing and abusing their privilege to allow him to do it? You assume he's acting alone... what if he wasn't?
The best lies contain elements of truth... or are almost entirely true. Find a legit reason for bypassing security and while you're bypassed, abuse it without getting caught.
Because violations and exceptions to policy are logged and those logs are periodically audited. There is a process for achieving access with an exception to policy for various approved reasons. Deleting entries from access control logs requires an accomplice that doesn't mind jail time. At some point this starts to sound like a crazy conspiracy theory.
I find the most simple answers are generally the most probable. Let's not forget this went on for nearly 20 years and security staff gets rotated.