A couple of years ago I verified that they really only just looked for *.edu.* in the domain part of the email address. I could easily enroll with something like john@edu.my.domain.com . I reported it but they didn't give a damn.
While they did not respond to your report. They currently definitely make it hard to pull something like this, as they will ask for real docs to prove that you are a student.
Oh, they did respond, they just wrote that they don't give a damn. I guess they care now. As I remember this was way before the Microsoft acquisition though, so there is that.
Before MS acquisition, they were a small player. The GitHub education pack was much smaller in terms of what it offers than today. This means it was less of an abuse target, and probably some of the contracts between providers and GitHub is that they must have a restricted student verification process. They afforded to ignore that before, but can't today.
