Hmm. Grounds for his conviction seem suspect and eligible for appeal:
1. The person who has the contract with the academic institution, and thus the person who has committed fraud in relation to that contract, is the student, not the stand-in exam taker. The exam taker has a separate contract with the student, which taken in a narrow contract, was not performed fraudulently but rather at the instruction of the student and as specified and requested by the student. That is a private matter.
2. His use of the students' credentials was authorized by each of the students, so it is questionable whether this was "unauthorized access". This (the login step, consdered in isolation) s analogous to someone assisting a, for example, visually or physically disabled person to log in to theiir online account.
3. Would disappear if 1. and 2. are not found to be not criminal for reasons similar to the above.