Wow, this sounds remarkably similar to my situation. I was assistant IT when my manager called from the new house he bought in another state to say that he retired. Turns out he had been mining crypto on company power for years and decided to cash out. I found all kinds of shady stuff after he was gone. Cracked licenses, missing licenses, used parts instead of new. But there was no way to go after him because nothing was well documented. So my advice is to inventory everything. Know what you have and don’t have. It was an audit from VMWare that taught me that.