How did they obtain the PINs?

One can only assume that it is another example of poor methodology in the design of the bank's transaction sytem. I would suggest you try and get a statement in writing from your own bank that their staff cannot either do the same or use some other method to defraud your account. Just don't hold your breath while you wait for an answer.

If he was a computer guy in the bank then it would have probably been easy to do. After all he obviously wasn't a rocket scientist because he was caught quickly, so this infers that it was easy.

Sensible methodology will prevent these insider frauds. Unfortunately insider threats loom very large in most businsses, financial or not. They can be prevented, but the bank requires the will to implement the solution. The risk can be 'measured' and doesn't justify the effort - that is until it happens. A bit like traders getting carried away and ruining the bank, odds are it won't happen, nevetheless it does.