Jamie Raskin actually said...

Since then, churches and other c(3)'s have had to decide whether or not to directly violate the law and risk potentially losing their tax st...

The overall institutional sense that I get is one of basic passivity and reactivity to events rather than getting on top of it.

But how do they profit from it? They take over the student's account?

So just to get you straight there, they are using your website essentially as the framework to access their victims.