There was this from a few years ago too: http://www.securityfocus.com/news/10611 -- I think it was the same sort of "append a param to the URL" event.

We're at a gaping chasm of misunderstanding here. Tech people see websites as things to be used and toyed with. Non-tech people see websites as things that have terms of service that are supposed to legally restrict what you can do. "YOU MUST NOT ACCESS THIS WEBSITE IN ANY AUTOMATED FASHION WHATSOEVER."

They argue on a basis resembling: "You wouldn't break into the admissions office and steal the list of accepted candidates, would you?" We counter-argue that it's like knowing a person who can't lie to you. If you ask them for the result, they give you the result. Is it illegal to ask for an answer if they don't even hesitate to give it to you?