If I was in Valve's position, I would blackball him from working there because he couldn't be trusted, and the damage he caused.
Damage caused was at least time spent cleaning up his mess in their network. Conversely it sounds like Valve had a very weak security setup in their network.
Assuming those sorts of cases actually happen, how is this any different?
and if memory serves me correctly, he was eventually caught shuffling credit cards that they captured back out for a tidy profit.
The kid recognized what he did was wrong and regretted it. That was why he came forward and emailed Gabe. If he really just wanted steal and cause harm, he would have never been found or caught. You can tell he truly loved the company and was simply misguided in the way he chose to show it. Yes he made a mistake, but I would have still given the kid a chance rather than beat him down. It's this kind of tragic beat downs that often create villains. (in the worlds of comic books at least. =)
I don't think what this kid did was actual "stealing". Had I been at Valve in a position to hire, I would have definitely considered hiring the kid (after evaluating how contrite he was, and how good he was, and on the condition that he keep his mouth shut, for fear of spawning copycats). But maybe that's because I've done such rebellious things in the past myself, and have a soft spot for true "hackers".