You may also want to seriously consider removing all non-select access to system tables except for 1 to 2 DBA types to eliminate this from happening in the future

You need to have sa_role to be able to write to these tables, and you usually update the tables via system stored procedures. So your (good) suggestion is actually already implemented. In addition, updating the tables directly requires setting a special "allow update to system tables" flag.

Michael