Benign instances of that happen all the time. Picking out actionable anomalies from event data like this is one of the big problems in information security.

They do, according to the article:

“Apple grew more suspicious after seeing his increased network activity and visits to the office before he resigned, according to the complaint.”