Legality of a scenario

Is this scenario legal,

A school has a few public computers that can be used. The only browsers that are installed are chrome and internet explorer, and the entire network is man-in-the-middled. Keylogging records are kept by the school as well. This school gets the account details of the student in question, and logs into the accounts of the student. The school gets records of things said at school through a chat.

The school argues that because the student logged into the account on their network(s), that they can legally view what is in the accounts, even if they do not own them. On top of this, they also say that they have the authority to view the messages because they were sent within the network of the school.

The student dictates that the school's actions are illegal. The account(s) that have been compromised do not belong to the school, and the student says that regardless of what network he accesses them on, they cannot legally obtain the credentials.

Who is legally correct, the student or the school? What laws dictate as such, and why?