He had the various binaries on his public home space, probably mounted to every machine via NFS, under his own name - and this was inside a company, so it would be his co-workers potentially using it.

That's quite a few degrees of separation from anything like a phishing attempt.