My university required registration of MAC addresses for whitelisting & bandwidth metering. My enterprising roommate and I worked out that we could bypass all bandwidth limitations by spoofing the MAC addresses of machines in the computer labs as long as the machine was turned off. We eventually got caught for using something like 90% of the university's total bandwidth - the security admin was thrown for quite a loop when he tracked down the machines that were supposedly using all of the bandwidth and found that they were turned off at the time. Apparently it took some creative techniques to figure out where the traffic was actually coming from.

Our punishment was something like two weeks with all internet access revoked (except for the use of lab machines for classwork), plus a written apology, plus a signed agreement not to violate the acceptable use policies again or else face the real punishment for what we did.

The school administrator in charge of the punishment asked the security admin what we were downloading (this was when the MPAA/RIAA were cracking down hard on people uploading files on sharing networks), but the security admin had mercy on us and told her he didn't think it was relevant, thank god!