I think someone should put a poll on this topic...
You had a player that found a security vulnerability and exploited it. Your fault for not setting it up correctly. His fault for exploiting it.
Pretty much agreed. Though the security vulnerability is more of a mistake. Exploiting errors isn't a mistake.
My story:
The government is responsible for a weapons surplus warehouse. For 10 minutes the warehouse isn't guarded because there was a mix up in guarding duty times. A civilian walks into the warehouse by accident. He finds no-one there and takes a few guns. He then gets angry at a few people and starts firing. Once he starts firing he doesn't stop.
Who's fault? Many people will blame the government and the guards. Yes. But the person?
No.
It's just too hard to resist taking free equipment. As for the killing - maybe he had a mental condition...It's everyone's fault, but are you going to blame everyone equally?