You’ll have to clarify who the counterparties are to this contract and where the person whose credit card was stolen fits into it.

I don't doubt that stolen cards are involved, but you could say that for anything that has to do with card-not-present transactions, e.g. Amazon retail. Is there reason to believe that it's especially prominent in this case?

I assume most of it is just people who want cheaper access to these models and don't mind subsidizing access via somebody who is simultaneously distilling the model.