I was a developer on the CMS in question when this happened. The possibility of this guy getting up to 10 years seems harsh.