I've been using this NN for a long time and I don't want to change it so I try not to post anything that might identify me together with all the other things I've posted on here over the years.
It's not possible to tell what MN's governance, risk and compliance strategies are or whether they are adequate based on what they've told us so far. MN is quite a small company and although they have had previous experience of Jeffrey and other hacks, it's not easy to deal with a new experience (employee misuse) in the heat of an emergency situation.
You can have all the right strategies (I'm not saying MNHQ does) and still not anticipate employee misconduct. Although she was an intern, EH was an intern press officer whose professional responsibility is preserving the reputation of her employer. I don't think the fact she was an intern is, in itself, a problem if she really needed to have access to that information (which it turns out MNHQ decided she didn't need). It sounds like a professional internship rather than your next door neighbour's nephew on a make work project and the press officers I know would see what she has done as a career terminating move.
Your next door neighbour could have access to your bank account details if she works at a bank or can see what porn is watched on your TV pay per view if they work at your TV supplier or see your location at any given point if they have certain roles at your mobile phone provider or at an app which uses your location data. I once called my bank and it turned out I sort of knew the person on the phone who knows lots of people I know (got chatting while the system was lagging). I have to trust he is not going to tell them about my finances and I rely on his professional integrity and his employer's processes and willingness to fire and prosecute him if he does. The important thing is that there are good training programmes, technical and security measures, compliance etc. combined with robust sanctions on employees who breach that trust, including being sacked, reported to the police and any professional bodies and being sued by their employers.
MNHQ need to take these follow up steps just as seriously as reviewing compliance, security, technical measures, training, communications etc. if they want to send a message to future employees and also reassure their users they take value their privacy and will look after their data.