In high school, I noticed that our home directories were school ID # + first few letters of last name. The ID numbers were vaguely in alphabetical order, I forget if by first or last name. While the contents were hidden by permissions, I figured out the school ID # of a classmate who had a near school ID # just from the directory name. That was a bit problematic because teachers would use them to post grades in an pseudo-anonymized fashion, the lunchroom used them for accounts, and who knows what else.

I didn't mess with anything, but I did say something to the my tech teacher. She knew I was a sweet kid with a knack for tech and some extra curiosity. She passed me off to the school system administrator, who happened to be a family friend. We talked it over, he asked me not to share my discovery, and that was that. It's been a good twenty years since then so hopefully they're switched to a way of provisioning home directories that doesn't spew PII everywhere.