In addition, I imagine a list of students who had finals in those buildings around that time also entered into the equation. Talking to the guy using tor at the time, who had finals at the time, is a no brainer.

he wouldn't have gotten nabbed in a court of law -- all you need is a motive.

I doubt that the "finals list/tor usage" combination would have been enough to convict him, but I suspect it would have been enough to get a search warrant for his computer.

I don't know if he used the Tor Browser Bundle, and if that is even all that clean from a forensic standpoint, but I certainly wouldn't trust it to conceal what I did.

Maaaybe he'd have a chance if he used a LiveCD that they could not find evidence of him ever having. That is a very strong "maybe".

Here's what the young lad should have done, had he had really thought about this: Use a LiveCD to boot with Tor on it, and also tether his cell phone to his computer, so he wouldn't have to go through the campuses wifi. Then the only way they'd have know he used a Tor would be if they checked every student's phone usage -- which would take too long -- and therefore they'd never have found him. Or if they did, they couldn't prove he did it because he used a LiveCD and tor had no trace on his machine.

Or he could have just not emailed a bomb threat.