A compromised Cambridge url gives a lot of credence to their claim though, especially with the paranoid coinbase developer they were targeting.
Traditionally students got a lot of leeway with running their own stuff maybe there have been a few doing not-good-things?
Lots of academics who don't take security seriously have had more admin access to live servers than they should and then stuff like the article happens?
Why? All student accounts were hosted under stud.ntnu.no; presumably authors of spam filters made other associations when they saw the string 'stud' than it being short for 'student'.
Cough. Their practice of automagically generating user names based on parts of your first and last name in my time led to two users having (for a short time!) the addresses hung@stud.ntnu.no and pervo@stud.ntnu.no.
Brenda Utthead feels their pain.