I wondered the same - the timestamps would have shown that the bad parts were made after the coworker was clocked out (making it unlikely the coworker actually did them). That could be verified against security footage/badge access records of the coworker leaving the facility. Then they look at who was clocked in that also works at that station to see who the real culprit was - especially given that it was an $84,000 mistake.