I have a story from the other side. In the late 90s my university RA position involved installing and maintaining a network in a nearby school district. One day, a teacher at a junior high indicated that one of his brighter students was "messing around" with one of the workstations. I took a look, and sure enough he had rebooted it with a linux CD-ROM distro. No problem. However, there were clearly multiple logins for people who weren't students, and the server was accesible from outside the network. Problem. Further tracking led us to a password sniffer installed back at the university, which in the 90s was serious business (and a whole other story).

Once the teacher understood what was going on, he quickly ran it up the chain and we wound up in a vice principal's office with an SRO and the boy's parents (SRO = School Resource Officer). I was a pretty bright kid in high school and the one time I wound up in a vice principal's office, it was pretty unpleasant. However, when the kid walked in I think he outdid me -- he instantly went #ffffff and almost fell over. To his credit, once he started breathing again he was honest and open about what he did. I tried to emphasize that he didn't act out of any bad motive, so I'm pretty sure the worst punishment he received was that office experience.

In retrospect, I'm glad I was there because (even as a college student) I had enough credibility to explain the situation. I did not keep up with the student, but I hope he went on to much career success.