Nowhere in the article is it mentioned where the student gained access to a mapping of student IDs to student first and last names. As a recent BHS alumni, these ID numbers are not obviously derivable from a student's name (but I do think they are allocated sequentially). Getting access to this list implies some sort of social engineering or threat vector elsewhere.