Using your credentials is not hacking, but once he was canned he no longer had authorization to access those systems. Legally, there is probably no distinction between gaining access by actual hacking vs. using credentials that are no longer authorized.

So yes, their IT processes are deficient, but that doesn’t let the guy off the hook or mitigate his punishment.