Yes, he may not have done those other things, but he clearly is responsible. He gave out the passwords intentionally so other people could do the work for him.
This highlights the problem with having little to no punishment for these sorts of crimes: the criminals don't learn why what they did was wrong and continue to do it.
$4000 is nothing if it means I can end all of this nonsense. If it were me, I would have no problem flying to Finland and making sure this guy doesn't ever do anything to me again. They went through the proper channels and the law won't do anything about it.