To me this is really weird. If a neighbor knocks on your door to tell you that you forgot the keys in the keyhole outside you thank him, you don't call the police...
No, the kid didn't log into the website and make some postings to their internal communication systems (forums, email listings, etc). He attempted to contact them through official channels but was ignored.
After that, he went to the local news agency. This is totally different.
OK, so he went into your room, you weren't there, and he came back to knock on the door to let you know he went to your room to find you. It's close enough.
Edit: I just want to clarify that I don't think the kid should be prosecuted, but I also don't like the fact that he went as far as to check for sensitive information inside of their system.
It would be like a passerby finding your door continuously wide open, stepping into your foyer and shouting to let you know, you weren't there or didn't respond, so he told your neighbor to tell you. Then you call the police because of trespassing.
I think it has to do with intentions. Not trying to literally map online site to a house. But in general, when a person has found a vulnerability and is trying to report it in a good will (no matter through what channel), as opposed to using it to try and blackmail, etc., things should not be reversed and used against that person.