They need to have a computer forensics investigator check the teacher's computer. If there really is no evidence of tampering beyond prank level then either that's all the student did or they knew how to cover their tracks; in either case, no evidence should translate to leniency in the charge IMHO.
