Personally, I'm a fan of some of his post-hoc justification:

"Following this, I took a hold of their Twitter account and posted a couple of bits to draw attention to the fact. This did two things. One, it showed people the system was insecure, but on the other hand people always subconsciously root for the underdog; I drew attention to the company and the product. I know a number of people have actually registered (or intend to register, registration is closed) for phpFog since the incident thanks to the attention drawn to it by myself."

The last bit is priceless. The mere fact that the kid doesn't show any sort of adequate moral judgement should justify prosecution.

Isn't the lack of adequate judgement (moral or other) the definition of being a kid?

At least he could be more of a kid and pretend. Which means I actually agree with you.