There's not much insightful advice to be given, chances are this guy could've easily traversed to every box on their network and set up a plethora of backdoors.
Without a "security expert" there really is nothing they can do.
Except some semblance of an idea of where to find a security expert. Even if it's a slight remix of "where to find ryanlol", that's plenty more insight and guidance. :)
(It probably seems obvious to you, but most people don't know where to find one.)
Without a "security expert" there really is nothing they can do.