I agree with Alice and Stephen. If they will not share the data, then you are out of luck.
You could argue that if they had not disabled directory browsing of their REST endpoints, then whats to stop you from hitting the unsecure service endpoints with a query like this to pull back the points your after (also with the choice of asking for them to be returned in a coordinate system of your choice).
However, they are making use of ArcGIS Server's secure services and you need to have a token in order to use these services. I expect this token is binded to either an IP or a URL, and thus its a good example of a secure implementation (vital for public facing sites).
This answer is not intended to promote data scraping of public facing ArcGIS Server instances, but to encourage any ArcGIS Server administrators to ensure they do lock down their public facing sites. Anything that is left open is vulnerable to misuse, and even if data privacy is not a concern, an 'attack' from a malicious user could cripple your hardware or give you a big bill on Amazon Web Services.
In short - ask them. If they say no, you will need to source the data elsewhere.