They are de facto sold via other channels too, sometimes with the consent of IAG or part of it.

If bought from an individual person, then that's a different story and going to be problematic if identified. If paying another person to engage in legitimate business activity to get use of 100,000 points, that may be another thing too, which may be legitimate but isn't necessarily so.