I don't understand how the word "leaking" would apply here. Unless there was an unmentioned login wall for the directory he scraped, the site is mirroring the names and faces off of a much larger and already public site that nobody has said a single word in complaint of.

It's not public, it's just accessible to the student body. The directory has restrictions on how it is to be used.

Those restrictions are presumably not going to permit a user script that adds a "harass this student" button to the directory page, either.