I know it's popular to blame malice on part of organisations, but I don't think it's in the interest of the school to overlook this. In fact I heard about this in a discussion/information saying how this was a problem and what to do about it.

Yes they require a passport at registration, but it's difficult to decide for an admin who sees someone for 2 min and looks at the passport for maybe 10s that that person is not the person on the passport. Especially so if you are not expecting it and the person comes from a different background (we struggle more with distinguishing people from other ethnicities)

I think this is how they got wind of the scheme though, someone got suspicious.