For a computer learning place thingy, they ain't too good at thingying the errr thingies.
Change the URL to ...aa2... and you get someone elses 'work'. So I'm guessing that the folder names are user names as well. It is also fair to assume that this webspace is linked in someway to the place's central network by the fact that his college(?) e-mail is the same as the folder name. Therefore username+brute force pass checking+computersname/location/whatever = security flaw.
Tada. Instant stupidity. If I had any index fingers I'd be thoroughly waggling them at the systems admin right now.
To summarise: :doh: