In The Netherlands we have law to protect the youth against smart, sophisticated hacks (we're not talking about (D)DoS here). These people are then taught lessons about ethics an how they can apply their knowledge for Good.

As such, my proposal of punishment would be to give this fellow an unpaid, mandatory internship at Twitter. This teaches them to learn their victim, and Twitter can teach the perpetrator the proper way to handle a company's problems. Show him how fun red teaming or blue teaming or pentesting can be.