What makes you say the guy is a Token hacker?

How do you know he hasn't paid for them, or won the Tokens legitimately?