When I was in school, there was a vulnerability where you could reach courses that you didn't belong to, simply by changing the id in the URL. A couple of students got punished (banned from school computers for months) for exploiting this (to leave a message on said courses). As of a year later, the vulnerability was still not fixed (although the messaging infrastructure was disabled).
Security on the old Macs was hilarious though - the student user accounts had a limited set of applications they were allowed to launch, but it was only enforced via Finder checking when you double clicked it.
There were so many other ways to launch things. Custom buttons in AppleWorks toolbars, AppleScript, dragging it into Safari and then opening it from the downloads manager, and setting the creator code to match any application you had permission for were convenient options.
Don't have access to run Script Editor? That's ok, type applescript: into Safari's URL bar and it'll pop right up.
My family made a fuss when they wanted to expel me and I switched over to Electronics. Had a grand time.
They apparently missed that another group had already created their own domain admin account, and didn't notice that until some weeks after the net send incident (I think it lead to them paying closer attention for anything unusual happening). I do think they brought it on themselves to some extent - having a domain admin password of "school" (easily shoulder-surfed), later "<name of school with an o replaced with a 0>7" (ophcrack made short work of that one, using cached credentials), and a VNC password of "vnc" (server installed on every machine in the school), is asking for trouble.
Fortunately they weren't malicious, just curious (the most "damage" they did was changing a single pixel in the desktop background of all users to see if it was possible) - they even slipped a note under the IT Admin's door with the current domain admin password on it, but apparently they either didn't see it or didn't act on it. Given they had write access to every user's network drive, it could have been far worse. It ended up being a lesson in OPSEC as well - getting logged on a rogue domain admin account using a device called "<family name> USB" is a bit of a red flag.
I think the punishment was pretty fair though (despite some initial ranting from senior leadership about suspensions and getting the police involved - cooler heads from the deputy leadership and IT technicians prevailed) - helping the IT technicians out for a week, which amounted to cataloguing hardware (chasing down services tags), and re-wiring a couple of the computer rooms.
We often shared our computer lab with others, so whenever they came into the room we'd shut the computer down and watch them get confused, move to another PC and we'd shut that down too.
after that i think either the CDC or l0phtcrack or one of those groups posted a way you can get to the user/groups window with admin privledges. i did that on one of the library computers which was logged in with the library account and deleted the admin group. what a shit storm that was. i was never caught for that one thank goodness.
i was a terrible script kiddie!
Were they only viewing material? Students viewing (and perhaps learning from) extra material should be commended! :)