Are you kidding? He manipulated the URL without explicit permission. This is a clear violation of the Computer Fraud and Abuse Act, and moreover, hacking!