> He didn't hurt anyone or even mess with their files in a naughty way.

I've had people deface sites. It's stressful, upsetting, and a lot of work. You can't really trust a compromised server, and school IT is fairly unlikely to have great processes for it.

> I was so happy to get away from school and this kind of bullshit.

The real world isn't likely to look any more fondly on this sort of behavior.