I thought that was gonna be a trap/honeypot. They detected weird behavior so set that up to see if anyone would take bait.

Who would be watching that slack channel with a dozen of pictures per week? Or would the bot be spamming the pics in #general?

“Visitors since we went to lunch” should be “none”

This is starting to sound more fiddly than is reasonable for inside security on a corporate office. The real failure here is just that someone left the door propped open. That's easily addressable, and as it turned out, they caught the attacker anyway.