Re: How on earth...
Well, from business perspective it makes little difference. We make our key generation structured, so that one always knows (or should know) from which parent key is a particular end key derived. A hundred million should crop up either way. It doesn't matter which technique the employee used. Being able to do this is the problem.
One bar owner is always present at their bar, other requires that guests pay only in exchange for a registered receipt, still others may employ yet another technique. But a bar owner, who lets their bar tenders sell from their own bottles a mere few years after the establishment went bankrupt, such bar owner doesn't hold much promise.
The Avaya seems nice enough and expensive to replace (where I worked some years ago the IT people had to scour Ebay for used headsets a few years ago to keep the comms going), would be shame if the company should fall victim to such practices.