so he will check 40000 different IP's every once in a while?
He doesn't have to. Every time you sign into the game and every 15 minutes after that you authenticate to the Master Server, which records your IP address, time, and other information. It then cross-checks this information with any other instances of that BL_ID on different IP addresses and if there appears to be a discrepancy, it kicks both players. You'll sometimes see players being booted off servers for an error along the lines of "Failing to authenticate with the master server."
This also probably sends up a red flag for Badspot. He'll sign on to his system and get an overview of suspicious activity. If the keys have a history of being in two places at once, he'll deactivate the key for being shared.