OP has probably made a decision by know, but for future readers, I'd add my opinion. Since you mentioned a "school board" I am assuming this is a high school, and I am assuming they don't have a bug bounty program either. In order of preference.
- If you know who, report it to the actual IT person who maintains the system, probably not your school's helpdesk. I would do it anonymously if you don't personally know them.
- Report it to someone who is very tech-savvy and knows you well (ex. a CS or another teacher who just really happens to get technology and will not for a minute suspect you of any wrongdoing). Ask that they keep the info anonymous.
- Report it anonymously to the most relevant person by email, from an email/remailer that cannot be traced to you. Try not to make the email look to suspicious though.
The thing is this: If the school district actually told student not to "hack" the computers, what you want to make sure not to do is say this to the kind of people that wrote that document. You will be a "hacker sent from Russia" in their minds, they will inevitably misunderstand you, accuse you of hacking something, get you in trouble.
Second thing is if the school board / school admins either find out for real that it is or more likely misunderstand that it would have compromised student data, they will really like for their superiors not to know. You do not want to get involved with the school politics. Again, you best bet is a quiet, anonymous report to the lowest-level person who has the most direct control over the system and will fix it quickly, quietly, and competently.
Never forget to consider how a white-hat report might hurt you before you send it.