What is happening is that your students are
entering linux in single user mode, wich enables someone to enter an unix machine as the superuser, without needing to type the
password. This is not a bug, but a feature (of, as far as i know all unix flavors), for someone to recover a system with problems (like a corrupt /etc/passwd file).
There are ways to make it harder for someone
to enter linux in single user mode.
You can protect the image using the password option in the lilo configuration (so everytime you boot linux, lilo will ask you for a password). You can also rip runlevel 1 from your inittab.
Unfortunatly, if someone as direct access to
your machine, he/she can always find out ways to boot the system and have root access (but this is also true for Windows 2000), so the best solution is to disable entirely the physical access to the machine, or at least to the floppy drive