Your issue might not be just the rogue employee leaking certificates, it sounds like you were sharing one Apple Developer account between multiple developers which is also against their T's & C's

Really every developer should have their own account and work on their own machine

If you were all using the one account on the same machine, then Apple has no way of telling who did what