Two completely different issues: 1. Exploit discovery. 2. Automated service attack. From the information given, it seems Al-Khabaz did exactly or better than

Two completely different issues: 1. Exploit discovery. 2. Automated service attack. From the information given, it seems Al-Khabaz did exactly or better than what was expected of him for the first. But why, if he was simply check for the existing vulnerability after informing of the first, did he launch an automated attack? I suspect Dawson College has sound reasons to treat him the way they did for both instances.