It sounds like what he did had exactly the same effect as "using simple HTML injection to add a rick roll to something".

'But he achieved it using leet hacker skills' should not be a factor in determining the nature of the charge or potential sentence. That's along the lines of making a big deal out of someone using a "Subversion" system to access and maintain code.

By "using simple HTML injection" I'm thinking of a form where they don't sanitize input so you could put a <video> tag in the 'name' field and suddenly the video would appear on the page.

Getting access to the administrator account is pretty different.

Not for a high school student. School networks tend to be very insecure, and the students tend to see them as just another resource in their education.