What he did - wrong (though technically it should never have been able to happen in the first place if the correct security had been in place)