More likely they're running XP without any normal user accounts setup at all... and someone enabled the remote assistance service.
By "normal" I guess you mean restricted or limited? That would be very sloppy for a school I would have thought

Given its functionality RAS would do the job, but I was under the impression that it needed acceptance from the assisted machine user, and created a log?.......... not what you want for a prank I would have thought?

On the other hand, using NetBus, SubSeven or the like will be detected by just about every anti-malware and its aunt.