On a campus, it is very easy to trace anyone, especially since the University has full control over their network.

Although there's a bit more involved, it basically comes down to this: They monitor certain ports, known to be used for filesharing, or check recently opened connections for identifiable strings.

Once it triggers an "alarm", they log the connection, look where the request came from (ie., based on the IP address used) and voila, you're baked.

It isn't really the concern for legal implications I believe, but moreso the constant bandwidth consumption.

-- Mike