I see it coming down to two basic situations, Secret-Service-wise.
1) The kid spewed some drunken insults, called the President names, then puked on his keyboard, hitting 'Send' in the process. IF this is the case, banning him for life is an extreme over-reaction.
2) The kid spewed some drunken threats making references to causing some sort of physical harm to the President, then puked on his keyboard, hitting 'Send' in the process. If this is the case, then - not knowing who or what they were dealing with - the only thing to do in order to protect the President is to put the kid's name on the no-fly list, and put out an APB to prevent him from getting anywhere near the President.
The problem with any of us making a judgment on whether this was an over-reaction or not is that there is one key item missing: The text of the email. Unless that gets released, we don't know if the kid's statement or law enforcement's statement is the truth of the matter. I'm willing to bet that once the furor dies down, there's going to be a re-evaluation of the 'threat level'.