Yea you really only need the contents of ~/.ssh and you could access every server the laptop could.

Even if they didn't have production access, a lot of times servers are configured to easily hop from one to another. They could have connected to a development server and then just hopped to the DB server with the accounts it seems they were looking for.