I think he has the source code that can generate XBox Live Gift Cards by exploiting the server. Then convert them to Microsoft Points and then issue a refund over time.

He got greedy and got caught, I am sure it triggered some sort of loss prevention algorithm. Microsoft is not stupid and a $10M USD rebate would show up in a log somewhere and be read by a bot to flag it as suspicious.