The thing is the developer already knew they were stolen and resold. So this is likely just a tiny sample of what might be much higher numbers that go undetected. The burden of proof in their model is basically on the developers.
It doesn't account for, e.g. having your laptop stolen with the games installed on it, or charged-back keys that were never used. But the developer knows about much more than "a tiny sample" of the thefts that actually affect it.