>> The JSTOR application lacked even the most basic controls to prevent what they might consider abusive behavior

Was he allowed to download the documents? It doesn't matter what controls were in place. The question is basic, did he get something he was not authorized to take?