I am not an expert, but as i can see, when they first started from Harvard in 2004, they restricted the access to only @harvard,edu address (must have had some sort of Java script validation to check and allow only that domain)and later when they expanded to diff universities the same validations must have been modified.