> Having shared credentials for an account is going to make it very difficult to prove who accessed the system.

As others have said, if she actually used the system, access from her home IP might be enough to convict.

> Makes me wonder if this incident will open Florida to a lawsuit by the vendor.

Possibly, but that'd be civil law. I definitely wouldn't want to be in that agency's shoes right now.