He didn't access his own account. He set up a "fake" account for a 'fake' employee that didn't exist which could be done even using the HR link if he he had access to add records to that database. Or he could have set up additional access on some other employee (say a driver) who rarely used the wider computer systems and wouldn't notice the extra access.
But HR links like that don't really work in the real world anyway. It doesn't allow for most large corporate set-ups where mainframe needs to talk to linux box that needs to talk to an oracleDB that needs to be accessible by a java batch job that needs to write output to the windows domain server file system so a human can check it before uploading it to an SFTP gateway box for an external customer to collect.
You don't just have accounts that are pure user accounts. You need mechanisms and accounts to allow system to system communications and logins for moving data between automated systems and for a large company it would be easy for an admin with sufficient privileges to hide a back-door amongst all these inter-system communication accounts (or even just hijack one or two legitimate ones, having copied passwords and other keys).