I think the school have him access to the athletic service software and he had the skills to access and crack the user credential file - see Brohio's latest comment below. Knowing the names, email addresses, schools, and passwords for a huge population of student athletes made it relatively easy...