I feel like, for consistency, if she committed a firable offense, so did her coworkers who LGTMed the CL, unless she intentionally deceived them about having gotten organizational approval.

My gut is that if she had spammed a bunch of internal mailing lists, she'd not be being fired or even getting a formal reprimand. But the fact that she hijacked an internal security tool for an unintended purpose is alarming. I am fine granting Google rights to run arbitrary code on my browser, but only because I know it has strict processes (including disciplining of employees who subvert the process) to manage submission and deployment of that code.

My preference here would have been for her to get a rebuke and an explanation of why this was bad behavior (unless these ad hoc non-security related messages are common), especially since she's young. But there is a core assumption and trust that is violated when someone abuses control of trusted client code to do something unapproved by organizational review processes.

Most of my anger is directed at the approving coworkers, since they should know better, assuming they are more senior than her.