Apple says his account was linked to the fraudulent account. They define "linked" as sharing test devices, and having been enrolled under the same credit card number. The accounts were linked.
They say to the developer that if he explains exactly the above then his account will be re-instated. It's not a "fake review" if it's stating the facts.
The part where we can assign blame to Apple is where they failed to notify all "linked accounts" when one of the accounts was engaged in fraudulent activity. They only notified the account engaged in the fraudulent activity, but went on to shut down that account and all linked accounts.
If they had notified all linked accounts then the developer claims he could have taken steps to resolve this much sooner. (But to argue for Apple's side here: Apple views all linked accounts as a singular "legal entity," and so assumed notifying one was the same as notifying them all.)