Publishing without an affiliation while having one
I cannot answer to each aspect you are interested in (legal, ethical, and other aspects) but I would like to mention some general aspects one should consider:


Most universities have publication guidelines which includes a paragraph about affiliations, see e.g. page 38 of the Guidelines for  research  integrity of ETH Zurich. 
University prestiges and university rankings are partly based upon publication output. Some rankings use Web of Science and a publication is not assigned to a university if the affiliation is not given in the publication.


As you mentioned that the work was completely written in private time, the situation is extraordinary. I'd suggest to talk to the professor and the university administration. At least the author should give credit to the university (library) for the literature supply.