They only need to slip up once and connect to facebook for it to unmask the employee from their device. I highly suspect they are not as anonymous as they think. Especially if they are connecting to an internal guest wifi at the office. You can get so much from metadata that you almost don't even need to know the content. Guess it all depends on how good their internal logs are at connecting wifi access macs with facebook logs. I'd wager it's pretty good as they already do this type of stuff to guess who your friends might be based on access proximity.