That takes some effort on the kid's part. MusicFirst disabled the ability to upload a file, so the kid basically had to play the teacher's recording from one device into the mic of a different device. You're correct, the student's director should have caught that.

This could also be solved if directors were required to be part of the recording process. We did not even give kids their login information, we required them to come to the band hall and record. Mostly because we wanted them to record on our good equipment instead of their crappy Chromebooks, but it prevented shenanigans.