If they've known he's been doing it for 2 years and haven't take any action for 2 years, then I feel it's a mixed message, that they have tolerated it, maybe turned a blind eye to it whatever. Maybe it suited them to let it continue or maybe it was due to inertia.
In their position the minute I'd have found out a discrepancy I would have covered the matter with him and got things back on track, not left it for years and then decided to throw the book at him.
I am not excusing his actions, I just find it incredible he is being potentially done for gross misconduct under the circumstances, and not given the support of management
People do all sorts of things to push the envelope, give them the message that it will not be tolerated and it gets sorted, they shape up or ship out. Leave it, take no action and let it perpetuate, and it gives the message it's a more fluid situation.
I am not convinced it is gross misconduct, and I wouldn't just sack them without a thorough investigation, and give him the chance to explain. I hope that's what they intend to do.