This question has really brought out the armchair lawyers!
In my view, the most straightforward way of dealing with this is as gross misconduct.
I don't necessarily agree with all the fuss about internal security in the other answers.
The most senior IT staff in a business are always in a position to configure the computers like so, and there is no oversight because they are the overseers.
There's absolutely nothing extraordinary about it, especially if a single person handles the entire IT function (quite plausible in a business with 40 PCs).
Just because a particular wily scheme has been discovered does not establish that there is wider irresponsibility or maliciousness against the employer.
The most likely justification they will have in their own minds is that they are using "spare" or idle processing capacity in the company equipment for mining. The question isn't clear about how much spend there was on additional equipment, or how the OP is clear that the equipment in question had no business purpose whatsoever.
I think the answers saying "don't touch anything" are laughable, as if a business is going to tolerate its entire IT estate being impounded, whilst they hire and apply a battery of lawyers and forensic computer experts.
In terms of seriousness, if the staff member responsible is a teenager or in their 20s, and probably not paid very well, I'd be inclined to think this is the kind of irresponsibility and nerdish cunning plan that could be expected. Having discovered the situation, it might be best just to tell them to unwind it all and give a written warning.
If you're dealing with someone much older who has the proper status of a manager in the business with serious responsibilities, it's perhaps a sacking offence.