At my school for whatever reason I was able to change for whatever reason the hosts file. I changed the popular mail service to redirect my clone site to collect passwords... I got caught in a week.
For some reason I still don't understand today, 9 of us in my high school programming class had read permission on absolutely everything. It was only students numbered "01" through "09" in that particular class -- I checked the border conditions in a very OCD-style.