That is totally for you to decide. There are no laws requiring or banning employees from having access to company sites while on leave. It all depends on the terms of the organization’s leave, IT and network policies.
Yes, if the employee engaged in actions that caused the breach. Being on leave isn’t immunity from deliberate acts of sabotage or generally complying with your organization’s IT security policies.