The contributions are legit. Despite his claim to have never spoken publicly about his contributions before, he has spoken about them (when it was convenient to make a point about his moral superiority). He donated hundreds of thousands per year to the Apache Foundation, for example. Additionally the WordPress Foundation’s financials are public, they don’t receive many donations (tens of thousands per year).