The spy was also a customer. This is two pretty broad violations of your usual HR policies at minimum even if you remove “spy” from the equation and ignore all the sales to sketchy parties.

The spy being a customer is not an excuse -- it raises more questions as to how they passed KYC and compliance requirements to be a customer.

It's normal for B2B companies screen for this before you even get a demo.