You go to your boss and say, in this order:
- I have locked everything down so that an attack like that will not happen again
- Insider attacks are always harder to defend against. For example they might take advantage of knowing some of us use the same passwords for several things. Practices that are perfectly safe against outsider attacks can leave us vulnerable to insider attacks
- If you want to investigate the source of the attacks, I have quite a lot of data gathered already and can look into it further if it's important
- I am personally convinced precisely who it was, though I couldn't prove it in a court of law. Let me know if that's something you want to pursue.
These are the things that matter to the boss. The direction of the conversation after that is up to the boss, not you.
The reason for this order is so that the boss can wander on a tangent or end the conversation at any time and the most important stuff was still covered. So after the first sentence, the boss may just say "good job, thanks, bye now" and you at least led with your accomplishment. After the second sentence you have mentioned that this wasn't a general failing to protect from strangers, but at most a minor flaw in your preparedness, and planted a seed about just who it is that reuses their passwords like that. The last two sentences have specific prompts for the boss to tell you things because if you've been allowed to say this many sentences, you're not getting shrugged off and can ask for authority to investigate and report your findings.
As suggested in the comments, repeating this information in writing is probably wise. Start with "as we discussed today" and quickly summarize whatever you managed to say in the conversation. Then if there are things you didn't get to, include a segue like "you should also know that" and add your extra information. Keep it short enough that you don't need to rely on other people to summarize it later if you end up the topic of discussion a level or two above you. (One or two sentences per point, as in my bullets, I suggest.) Offer to meet again to discuss any of this in more detail if that should be needed.
Keep a copy of this email somewhere else; for example forward it to a personal email account if that's not a violation of company policy. Print it and take the copy home, despite that being a super easy thing to forge at your leisure later. If you know the date and time, subject line, etc (which are on your printout) the company can probably find the email in a log somewhere, which is not so forgeable.