The technical details don't much matter. What matters is what the users do with it, and whether their uses can be shown, by a prosecutor, to represent the kind of access that a reasonable person looking at the same computer system would know was not authorized.