I disagree. See my post for why.

The company's mistake was allowing a 'newbie' to place scripts on their site.

Yes

However, site policy was only the weapon.

Not in the sense that you mean. Good operating systems have the ability to limit badly behaving users so they don't take down the system. If I were handing out accounts to unknowns, I'd expect to have to harden the system appropriately. This is 'system policy' the way sysadmins think about it. You're probably referring to 'written policy', which is usually worth the paper it's printed on.

You put the bullet in it and handed it to the criminal to pull the trigger.

Please don't use violent metaphors, there are plenty of better ones to choose from. Like sexual metaphors. Gets the point across, but is a happier thought.