If you find a message on the lav mirror it could be anyone of 400 or so idiots with a perverse sense of adventure, and the threat level is probably low. To be able to write it on the tail some 30 foot in the air means it was likely somebody with airside access, probably involved in a maintenance activity, and with more than just a passing knowledge of the aircraft systems. I would think that was justifiable cause for concern from the FA's.
Sounds to me like the captain made the correct call (he or she was trying to operate an airline), then the F/As decided they were in command.
Last time I checked the captain was the PIC, not one of the folks working the cabin.