Answer:
First, why would you ever leave an account open under these circumstances? The account should have been closed and a new account should have been opened. Checks coming in with the account number on them does not represent your only risk or liability in such a situation.
Second, you had the potential perpetrator/thief on-site and failed to act. The police should have been called and additional information, such as ID should have been requested and maintained and the individual should have been delayed, unless the employees felt there was an immediate safety risk presented.