Hmm, legally I don't actually think he did anything wrong cause afaik there isn't any kind of law that, well, tells you to return back something you got accidentally or not. If I'm wrong then feel free to correct me though. Morally, what he did was really wrong. I mean if it was a few bucks then maybe, yeah I guess I'd take it (don't call me on that), but if it was THAT big of an amount? Heck, I'd think something was wrong and try to contact the bank to ask who sent it or what the actual hell happened.
I have to say whoever sent the funds should also be accountable though.
Actually, both parties are accountable in this scenario as the organization made a mistake on sending money on the wrong account however they are entitled to recover the funds. Also, the person who received it have spent the funds knowingly that the funds he received is not his.
Upon doing a quick google search, I was not able to locate a certain law that indicates wrong deposit made however there were some situation that I've found where people who refused to pay the amount they mistakenly received, has received consequences from the court. Also, most cases are against the person who received it and spent it.
Anyway, this makes me think that if this happened on a crypto transaction, the person who received the coins are not viable to any kind of consequences or even responsible to return it. Probably, mainly because of the anonymity of the owner of the wallet compared to owning a bank account where your information can be retrieved.