Most school hacks carried out by their own pupils, watchdog says