The session, which left nine players hospitalized, was run by a person who lacked credentials, a review commissioned by the university found.