The most severe penalty that should attach to repeated unauthorized access of a school computer is expulsion. And that should take a while.
If there was proof the kid was doing other harm using those computers, maybe that would be something where the legal system should get involved (depends on the harm), but the unauthorized access itself should stay a school matter.
If there was proof the kid was doing other harm using those computers, maybe that would be something where the legal system should get involved (depends on the harm), but the unauthorized access itself should stay a school matter.