This is very similar to what Weev was indicted and convicted for.[0] Simply passing valid requests to a system can by construed as "unauthorized" if it is unexpected by the operator of that system.

[0] https://en.wikipedia.org/wiki/Goatse_Security