1) Not all Apple employees have access to this. Tech Support would. Apple's tech support knowledgebase is compartmentalized. Tier 2 ("Product specialists") have access to more things then the Tier 1 ("Frontline agents") do. Apple Internal is a higher level of trust than the regular knowledgebase, which leads me to believe this was a Tier 2/Genius.
The EFFA is a reference to "Early Field Failure Analysis", which occur when new products (even minor refreshes) are released. If there's a hardware failure inside the first 90 days of a product's release (not 90 days that the consumer owns it), they capture it and send it off to the Mothership. Frontline agents don't do that. Tier 2 and Geniuses do.
2) Apple does not run their entire tech support division. They have a few sites, and farm out the rest. There are sites in Sacramento, Niagara Falls, Peterboro (Ontario), the Philippines, Cork, etc. The employee who did this could be a vendor employee.
3) Tech support sites are supposed to be cellphone and camera-free. USB sticks won't mount. Email is internal only, except for geniuses/tier 2, which has access to apple's external mail server.
4) The IP address of the searcher and a timestamp is embedded in the knowledgebase article (white on white). If you print it (which not all tier 1 agents have access to), you can see it faintly on the page, so printing (even as PDF) wouldn't work out so well...