I think he has the source code that can generate XBox Live Gift Cards by exploiting the server. Then convert them to Microsoft Points and then issue a refund over time.
He got greedy and got caught, I am sure it triggered some sort of loss prevention algorithm. Microsoft is not stupid and a $10M USD rebate would show up in a log somewhere and be read by a bot to flag it as suspicious.
Like it would seem to be a simple audit would discover that "Hey $10M more gift cards have been redeemed than were sold..."