This seems to me to be the major takeaway for organisations outside github from this sorry affair. I'm sort of surprised you are the only person to raise this so far.
In the UK, the employee who resigned could have a successful day in an employment tribunal. And one aspect of the hearing would be privacy and the Regulation of Investigatory Powers Act provisions.