Art. 15(4) GDPR says:
(4) The right to obtain a copy referred to in paragraph 3 shall not adversely affect the rights and freedoms of others.
If I was the controller in this situation, and I believed that this would endanger the students that have criticised the professor, I would base my argument for not complying on this.
In addition, Art. 85 GDPR requires member states to:
[...] reconcile the right to the protection of personal data pursuant to this Regulation with the right to freedom of expression and information [...]
So you may be able to argue that the students posting messages are engaging in "processing for journalistic purposes and the purposes of academic, artistic or literary expression", depending on the laws of the particular member state. (edit: this could be difficult since you mention it is a private database).
The second case seems just like the first in terms of GDPR, but may constitute defamation. Defamation (or libel) laws differ wildly in each country; he Wikipedia article on Defamation explains the situation in each member state in more detail.
In the third case: if the professor submits a request based on the rights of a data subject other than himself, they don't need to comply. These requests need to come from the data subjects themselves, not just a random person assuming authority. (although I suppose it's possible for them to give power of attorney to the department head if they wanted to) Personal data and the rights that GDPR provides to data subjects always relate to a natural person, not an institution or a company.
