Employee of the customer of the vendor!

The password was hardcoded into the executable you can download from their website. It wasn't unique.

The only trace would've been the database software the guy used showing up in the mysql connection logs, but if he used a VPN the trail would probably die there as far as Modern Solution is concerned.