When you impact JSTOR and the entire MIT network the way he did, it's hardly "in secret". Something like a stream of one million continuous JSTOR downloads 24/7, significantly impacting the entire MIT network, is going to go unnoticed?
His JSTOR use was heavy enough to draw an IP ban. Yet he continued. I fail to believe he was really trying to hide - he knew his actions would be noticed. Network admins would see what was going on. And even in the wiring closet, putting a bike helmet over his face? That's not exactly covert.
JSTOR would know something was up - the IP ban was probably automatic but still I would guess the folks administering their servers would have noticed a huge spike in activity from MIT.
MIT would know something was up. Their network admins are not asleep at the wheel.
Seems to me, it was no secret what he was doing. He did not try very hard to conceal it. (Or maybe you think he was supposed to hold a press conference or at least call the TV news first?) With the way he went about this, it's no wonder he got caught.
Moreover, he already knew he had an FBI file from the PACER incident. So it's not like he couldn't imagine the FBI getting involved.
Then again, I could be wrong. Maybe he really is that stupid.