I got called in to handle a situation where an employee was spying on his boss's emails. He got caught when a read notification went out from his account.

He got called into a meeting and when they explained what it was about he didn't say a word, but left the meeting, went back to his office, removed the hard drive from his computer and left with it.

I just had to figure out what he'd done, make sure he didn't have any further access, and fill in until they hired someone permanent. No idea what happened after that.