Almost any MIT affiliate can get a *.mit.edu domain name and host a website on it. The student in charge of the original probably forgot to protect against a simple SQL injection attack.
They bypassed that student's security and his website, not the "administrators at MIT" and "their website".
Both rledev.mit.edu and cogen.mit.edu are MIT departments (one the part of MIT powering much of campus, one a laboratory doing electronics). It wasn't a student's bad security.
They bypassed that student's security and his website, not the "administrators at MIT" and "their website".