Well, I'd start with university technology-use policies, which this student is quite likely to have broken. Where I am, policy contains the following stipulation:
Commercial, Political, and Non-University Activities
Users may not use University IT resources to sell or solicit sales for any goods, services, or contributions unless such use conforms to {university} rules and regulations governing the use of University resources. They may not use University IT resources to represent the interests of any non-University group or organization unless authorized by an appropriate University department.
Another possibility may be called something like "non-academic misconduct" (to separate it from "academic misconduct" such as plagiarism or cheating) or an "honor code violation."
If you care to pursue either of these avenues, you'll have to hunt down appropriate chapter and verse at the student's institution, as well as instructions for reporting.
If you don't care to be this formal, and if you know any faculty or staff in the student's department, a "what the actual heck is this and did you folks know about it?" email might be the way to go. Where I am this would certainly be grounds for at least a stern conference with the student, and at worst, non-academic misconduct charges.
