I agree with your attorney that it shouldn’t happen, but i can tell you from personal experience that it does.
Here is the most pertinent question. How did the agency know to monitor your unclass CPU for nefarious activity? There is noway they caught this just “incidentally”. They had to know what to look for as they would have noway of knowing that you weren’t allowed to log in to that acct. What did you do prior to this that put you on their radar?