I'm guessing he had been running the 'demo' site for a fair minute using scrapped data; but didn't get noticed/caught until he requested the token.

Still shit to lock him out after he pulled the site down.