The admin page is completely unprotected, you don't even get a notice about the system being private. They can't sue him, they wouldn't have a leg to stand on.
To me it looks like somebody left a "DEBUG = True" somewhere on the site and went to the beach :)