Very suspicious because a lot of characters have full 496, but vendor bought rings? This implies that he didn't get enough 496 rings to feed all of these characters, tossed the boosted gear rings, and bought cheap vendor ones. One character is even missing gear in slot entirely (not even a quested trinket to put in?)
Why would you wait until all the characters had 496 before announcing this? Wouldn't there be a few floating around in full quest only rewards? There's a ton of other suspicious things, armory avatars, equipped gear ilvl errors, etc.
I'd believe this is he had included a screenshot with his account transaction history, with some way proving it's his account (but without showing sensitive information of course)