If you find a message on the lav mirror it could be anyone of 400 or so idiots with a perverse sense of adventure, and the threat level is probably low. To be able to write it on the tail some 30 foot in the air means it was likely somebody with airside access, probably involved in a maintenance activity, and with more than just a passing knowledge of the aircraft systems. I would think that was justifiable cause for concern from the FA's.