I wonder if he was using something like PrintJobHistory while working. It’s not entirely uncommon for ordinary printers(mostly the bigger ones) to retain some print history; but given the amount of fine tuning that goes into the FDM stuff that can be an actively sought feature rather than just a vendor or IT-imposed metering thing.
Unless getting caught on the imports was just a stroke of extraordinarily bad luck I strongly suspect that he left metaphorical(and perhaps literal) fingerprints somewhere on the production and distribution steps. Secrecy is hard and people are terrible at it.
