TL;DR: It's Sci-Hub FUD.
Later the uni found out, asked questions and the person just lied they were 'tricked'. Uni makes a police report and the police just takes it at face value.
Why would anyone need to hand over their credentials to sci hub if it weren't for this purpose? Neither the BBC nor the police present any evidence of this "phishing" that I can see.
If I still had access to my university creds I'd totally give them to sci hub. They're doing God's work.