I would bet almost any amount of money that the computers the screensaver was installed on had at least 10x more unauthorized bandwidth use by the users than by this screensaver.

SETI@home on the computers I've installed it to runs for a couple of days, then (even on a dialup connection) spends maybe two minutes sending data back to the central server. (OK, maybe three or five minutes if the server or connection is slow.)

If I were the employee, I'd ask for the logs showing internet usage and demonstrate there is NO FREAKING WAY it cost $400,000. (On the other hand, if that distributed screen server works differently from SETI@home, he still may be in some very hot water.)