The person who authorized the system to be set up like that is at fault.
Accounts are at fault for not spotting this sooner.
Management are at fault for not realizing a such a flaw is exists and ensure a procedure, pre-dating the first incident, is clearly written.
As such if this went to Tribunal I believe the OP would win for the companies failure to be clear.
Assuming he's a model employee, I'd probably push for a 'first and final' warning.
Whilst hastily closing up the loophole.
If there was any other dodgy activity on record it would be instant dismissal.
There is a tiny amount of mitigation in that the system is flawed, but if I leave my keys in the car whilst nipping into the shop and you steal it, yes I was negligent on some level, but that does not excuse what is basically theft.
There is further mitigation if they have not followed disciplinary guidelines, especially for a serious breach.
In the real world I'd have to assume the company will move toward instant dismissal, why have a chancer on your books when there are plenty of trustworthy people looking for work?
Trying to see it from both sides here, but realistically there are 3 outcomes,
1) resign
2) prepare for a real fight (get representation), if he wins he'll have no prospects in the company and will need to find new work anyway but could buy some breathing space
2) if he loses he'll be sacked and will have to disclose this when applying for jobs
It's a question balancing the risk and I guess a lot of that depends on his personal circumstances.