I can't think of many schools who have their own IP range. They have a single IP, the entire school is behind NAT firewall, and the IP belongs to local cable or telephone company. It is very, very unlikely that reverse DNS would have yielded anything usable at all. The whole story is highly implausible and we all got taken by it.

TD Canada Trust (one of the largest Canadian banks) had one of their servers infected by this virus for at least 48 hours before taking the server down. I tried through a few different channels to get them to notice they are infected, but it took a day of effort until they reacted. And they decided to not alert their visitors that there had been a problem. In my world, a financial regulator would be all over their ass about something like this. You can see gory details at http://blog.cognistudio.com/