The following is information regarding how we set up and manage the accounts for the project:
Keep a spreadsheet to manage, record all account creation information (keys, passwords, secret answers, etc.) It's been a lifesaver.
I created a GMail account for each login. If you have access, I recommend using your district's email solution for this as after a year, Google had shut down several of those accounts (assuming them to be spam accounts?). A format like scpswow11@gmail.com, scpswow42@gmail.com, etc., is the way we did it. Other than using it to log into WoW, students have no need to access this account.
Update (12/2/2010): If you can use district-supported student email accounts, it may be better. Apparently Google thought I was a spammer and shut down several of the accounts over the summer. Recovering the accounts was challenging without access to the email account used.
We used the Recruit-a-Friend program. After creating the accounts, I used my account to recruit five of the email addresses created, my partnering teacher recruited five from his account, etc. As you begin to subscribe the accounts using your 60-day cards, this will grant your recruiter accounts free play time (thus less cards we have to use).
So, each of your student accounts get 10 trial days (recruit-a-friend), then 30 days from activating the game, before your have to use your first 60-day card. For each account recruited and done this way, the recruiter account gets 30 days free. You can have 5 invites out at a time.
The other nice thing about maintaining the accounts yourself, is that you can set up parental controls on each. If you don't want your students accessing from home, which they will given the opportunity, parental controls will allow you to block out the specific times during the week that the account can be played, such as Monday and Thursday 1:15pm to 3:15pm. If a student tried to access outside those times, they'd be denied. Use a single email account to establish parental controls, it's much easier that way. Oh, and parental controls can also send you play logs for each account showing all activity.
I don't recommend using authenticators with project accounts, because it would be way too much of a headache. We were very straightforward with our kids about sharing their password, especially for anything other than logging into WoW.
We simply recycled last year's accounts to this year's students. Before giving them their accounts, I logged into each from the previous year, sold all their gear and put the proceeds into the student guild bank... It was sort of poetic (tragically?). :P. Thus, our students, for this year, started with "fresh" accounts.