You're actually largely incorrect on this.
The Liverpool one involved the former City employees using an existing enployee's login credentials. I don't know how they got that password (although I'm sure City does) but I do know that the City employee involved was still there a few years later, and may still be. So he wasn't sacked, suggesting he wasn't actively involved in whatever happened. It still puzzles me why we didn't go to the police over this, as it was a clear criminal offence under the Computer Misuse Act.
My understanding of the Pinto hack is that it involved an phishing email designed to look like it came from UEFA, which was opened by a senior club official. You can warn people all you like and carry out regular phishing tests, but there's pretty well no way you can guarantee security if someone doesn't carefully check an email address every time before they open it or click on a link.