Look, not that many people use Tor in the overall scheme of things. If you find a bomb threat that seems to have originated from a Tor node, and you find that a few people on the campus network were using Tor around the same time, that's the obvious clue to follow. ISTM that you wish Tor were so good at anonymity as to spoof its origins to the webmail program from where the threat were issued, but that seems an unrealistic thing to ask. It's just a protocol, things like time-shifting or IP obfuscation are surely up to the person using it.

To take a principled stand of saying dissidents should have the means to communicate freely, you also have to assert that you'd like for this kid to not get caught.

Realistically he would have been better off to call it in using a payphone (to the extent that he considered a hoax bomb threat a matter of necessity). I don't think you can automate away a complete disregard for security.