Yea I am going to have to call BS on this. Even at my school no one person has access to this kind of information. You would need crazy clearance to get a hold of such private information.
If there were issues with x or y not paying their bills, certain people would need to know who's service to shut off.
The in-house developers probably just tried to cut corners, and combine two programs and databases into one.
Your schools IT department has full access to your information, the difference is that they are more professional, they won't disclose it, and they are intelligent enough to use their power correctly.