If your friend has ever been busted for selling miles in the past, thats one way they may find out.

If you have ever bought or sold miles and been busted, thats another way

If your friend sells you miles and somehow is contacted by the airline and they slip up and say they paid for it is one way.

If he books a bunch of tickets for different people and not himself thats one way they can find out.

If either of you have dealt with a mileage broker in the past and that broker has since been gets caught and gives up names of customers, thats one way.

If these are AA miles the odds are much higher of getting caught