You think they couldn't get a warrant based on TOR activity at the 8:30am time of the emails and a 9am test? I think you are likely wrong.
If they got such a warrant, it would have been thrown out (along with the seized evidence) later, assuming he had a decent lawyer. Your logic assumes that that police already knew that the bomb threat was made in order for a student to evade an exam. But they had no evidence of that until *after* he confessed. The bomb threat could just as easily have been made by someone who wanted to spook a student who was taking the exam. Or for a reason unrelated to the exam at all...
And added to this is the fact that the police had no evidence whatsoever that the bomb threat was made via Harvard's network. That was just a (not unreasonable) guess. But such guesses, while a staple of police investigative technique, are NOT evidence.
So at most, the cops had a guess as to the reason for the bomb threat, a guess as to where the bomb threat was sent from, and some evidence that *if* the bomb threat was sent via Harvard's network then this person *might* have been the one to send it. Hardly what I would call "probable cause".