He did manage to slow the site down significantly, to the point of being unusable. Not surprising given the code quality of an app where replacing the student id in a url parameter gives you access to their file.

However the vendor offered him a job and a scholarship, so it seems like it's the university's over-reaction.