To be honest I fessed up for no reason. All they knew was I logged in to some box. I could have made some stuff up about doing some legitimate work and I'd probably have gotten away with it. At the time I was extremely naive and dumb. My advice to kids is not to stop doing things but to simply downplay what you were doing. "No I wasn't hacking. I was securing the system." Etc. Come up with plausible reasons and the benefit of doubt will generally keep things from escalating beyond the IT staff. Once admins start talking about hacking you've lost the war of words.

It's as much social engineering as anything else.