If they were even slightly concerned that the scope went beyond what they were aware of with JSTOR, they would've either immediately contacted police or disconnected the laptop. The timeline in the report outlines that they discovered the laptop at 8am, and were in internal communications with their bosses and MIT's lawyers before someone finally contacted police at 9:45am.

They knew what was going on before they found the laptop. They had been briefed by someone at MIT who was in contact with JSTOR. I suspect that everyone on the networking staff (and possibly most of the university) knew of the JSTOR downloading situation after the second incident in October. JSTOR had blocked MIT for 3 days, and that must have caught people's attention.

Once they found the laptop, they involved police despite knowing to a virtual certainty that the problem with the laptop was that it was scraping JSTOR, again. They didn't know yet that it was Aaron, but they would've known it would turn out to be someone ideologically just like him.

There was nothing suspicious about it. It was simply jeopardizing MIT's contract with JSTOR. The use of a data closet like that was very bad manners.