[nithinm]

By purchasing the ticket, he was confirming the vulnerability. I am sure he knew that they would cancel the ticket when he reported it. I don't find any wrong doing here.

[underyx]

Also, since he doesn't live in Budapest, it should be obvious he wouldn't be doing it for personal gain — he has no way to use the pass anyway, after all.

[StreamBright]

And you think that this is going to be enough at the court?

Have a look at this list, many of them thought they are not doing anything wrong:

https://en.wikipedia.org/wiki/List_of_computer_criminals

The point is that we live by the law, not how you feel about a certain action. I agree that the law is a bit problematic but regardless we cannot cherrypick which law to follow and which not.

[kowdermeister]

Yes, that should be enough. You won't get into any trouble if you break a window when the house is on fire. This time, the site was on fire.

[bigbugbag]

The point being that he should not have been sent to court here, yet they chose to do so anyways.