Similar experience, their reasoning why it was so stern was because the password acquired was valid throughout the entire district, and used for multiple core systems (security, AD, grades, etc..)

No one thought to ask IT why they used the same PW 5+ times for critical infra, its all just the kids fault for finding one of them