According to the article, he was an investigator in the Department of Industrial Accidents. I suspect he had the laptop because he traveled to accident sites. Once there, he conducted the investigation, entered the data, connected via wireless, and emailed the reports. That was probably his only connection to the agency network. Printed output? Probably on a portable inkjet. Email connection most likely via Outlook Web Access.
It's not hard for that to happen, particularly with a dispersed workforce. I have no direct connection to my corporate network, not even a VPN. All I have is a broadband card and a userid.
In defense of my corporate IT, my laptop is legacy equipment from before a merger. My former corporate IT saved a bunch of money by using OpenOffice, Thunderbird, and other open source solutions for common tasks. Heck, the only reason the laptop runs Windows is so techs can use the proprietary software that configures and maintains wireless equipment and scales.
The laptop came with the corporate edition of AVG, Spybot S&D, and SpywareBlaster installed. Since I used to connect through public wireless, I run HijackThis and other security software at least weekly. But then, I know what's going on; it's part of my job. This guy probably only knew accident investigation.