The first error...

The first error in this farce was that the contractor trainees were using the live database for training.

Re-tellings of the story on NPR pointed up that the trainees were at one point requested to look up the data of a family member or close friend, (i.e. "We are about to breach data confidentiality. Please pick a target who will be unlikely to sue us or you.") Seems it was during training that the "unlawful access of data" occurred, or at least commenced.

Wiser practices would have had a training database to go with their training exercises.

Aside from the blatant inequality of an access monitoring system for the data records of "high-profile" people, this highlights the pointlessness of log files that are only reviewed postmortem.