Link me to a comment that is reporting that someone bought a game using their account
Beyond that, it's physically impossible to confirm that it's true.
As someone else said before, it could merely be fear-mongering.
Be it you buy something for yourself, or you make a fake thing with javascript for whatever reason, you can easily claim that someone else did it under this pretext. And besides doubting the authenticity, there's no proof, nor possibility to prove, to say that he's faking it.
This is a colossal goatforget.