Puzzle of the Day

A student suspects there is a vulnerability on a system where student grades are stored. She tests this by trying to exploit the vulnerability from the network (because she is not authorized to use the machine and does not have an account on it). She succeeds, becoming root, and reports both the hole and her exploiting it to the system staff, who in turn report it to the chairperson of the department. She is promptly hauled before the university's equivalent of our Student Judicial Affairs on the charge of breaking into a computer system.

1. Did the student act ethically by testing the system for the security hole before reporting it?
2. Did the chairperson act ethically by filing charges against the student?
3. The system staff did not fix the hole, because the action taken by the (equivalent of our) SJA would deter any future break-ins through that hole. What do you think of this?