You don't take a binary blob from a dubious website and install it onto a company machine, and if it was his own laptop, then you don't use such a blob to produ

You don't take a binary blob from a dubious website and install it onto a company machine, and if it was his own laptop, then you don't use such a blob to produce another blob and install that on your company's machine. That's such a damn stupid thing to to in so many ways. The IT security department has all the reasons to be angry, much worse could have happened than triggering some company's license monitoring system. Having said that, I hope they are going to let go on the student with that 30k.