Easy - they noticed the gamertag being recovered in different region (this is displayable on MyGamercard.net's leaderboards), since different SKUs of games have another batch of achievements
Also, the inclusion of known glitched achievements may have been a huge tip-off (Known candidates: Two Worlds (pre-patch), SmashTV (still not patched), Call of Juarez (still not patched))
Also if said person has his profile on memory card, he can then simply log in from various places at once, and get that gamerscore piled on
Finally - gamesaving, this is where you download saves (by use of third party devices), and load them up, allowing oyu to get all achievements for a game - apparently Burnout Paradise is affected by this