GDPR Investigation

Hey, So I've been informed that I have to take part in an investigation regarding my conduct at a workplace. Long story short, our General Manager keeps leaving their email account open and it contains several HR related topics re: staff incidents. I was doing office admin when I noticed the log in and saw my name mentioned regarding a separate matter. Unfortunately curiosity got the better of me and I looked through some conversation chains that directly insulted myself and other managers on site, with some language even being discriminating against my autism/adhd, as well as others.

I sent photos of conversations about me between the GM and Head Office to a "trusted" colleague at another site to discuss the situation (I'm aware of my mistake here in regards to GDPR, fumbled), and it appears this didn't stay between us and I've now been sent an email telling me I'm under investigation for accessing the GM emails without permission, somehow "listening to conversations I wasn't part of" and sharing information, plus not upholding my duties as a manager to keep information private etc.

Basically, I made an amateur mistake, which I accept. My main question is, however; isn't the primary issue in this circumstance less my discussing information pertaining to myself, and more the fact that this information was left fully accessible despite much of it being highly sensitive? I didn't share anything about anyone else but myself, but surely the fact myself and anyone else using the computer could even access it is an employer problem more than an employee one?

Yes, I was snooping and that's a breach, but the fact I COULD snoop seems a bigger problem, as anyone in the office could have done so.

I'm going to speak to ACAS in the morning to discuss in more detail, but wanted to also throw the question here for a moment to get some feedback.

Any opinions/advice here?