They break the algorithm and make a keygen.
So there goes my $15 that I spent on 4 codes. Maybe I'll try to get a refund. (ETA - the eBay item was removed so I can't even contact the seller)
So all it is is just some numbers? Microsoft doesn't have a way of verifying that it's a legally generated code? Like maybe having two lists, one with all the codes using an algorithm and another with only some of those being good. Or have a system where they only generate codes on a need basis.