All you'd have to do is grab a PAT from a terminated employee's workstation and you'd have access to anything they did, in their name, until it expires.
I, too, would argue I obtained them legitimately, by giving Claude access to the filesystem image and asking it questions it could only answer by doing exactly this.