I really doubt they pirated it. Schools get at least a discount, I myself, as just a student, can get it entirely free.
I can't comment on these "small details that were unusual" because it's lacking detail
There are some things (I really don't know what, perhaps odd configuration settings, registry entries, or maybe even malware, all I know is it's out there) that can make a windows installation report as not genuine. I've had it happen to me on a completely legit install