I have two objections, which the article doesn't seem to fully address.

First, do we know that the server the students designed actually met the spec handed to IBM? Often times a lot of the complexity of a project comes from the interaction of a few features. It's quite possible that the version the students provided didn't actually do the hard stuff. We know from the article that they specifically didn't address any security/privacy ramifications of sitting running in the cloud.

We also don't know how many similar projects were attempted and failed. Sometimes things just come together, way quicker and cheaper than should have been expected.