Are you sure about that? I was under the impression that the CFAA is broad enough that even if you have credentials to access computer systems, but do so in a way that was not intended, then you have broken the law. Intentional damage is included in that definition too.

Section (a)(5)(A): knowingly causes the transmission of a program, information, code, or command, and as a result of such conduct, intentionally causes damage without authorization, to a protected computer