A felony would almost certainly require real damages to the target, DoS or theft or the like.
Furthermore, the kid already told the school about his find and made no attempt to conceal his identity on his second connection. He had gotten no negative feedback on his first connection. For a website, any connection outside of the provided user interface is outside of the normal terms of service.
Neither of his connections to the site resulted in any action by the actual owner of the site besides perhaps a call to the school in a moment of panic.
All of the evidence supports his claims of innocence in intent, if not in action. Furthermore, he wasn't given any opportunity to give his side of the story -- if he was arrested or sued he would have been able to defend himself.
The kid should retain an attorney and sue the school for the damage to his prospects and reputation, then we will see if a jury of his peers feels he's lost touch with reality.