Could it be an inside job? Some employee, perhaps a lounge employee, has access to a stack of club passes that have already been used by their rightful owners. They would all be used.

For new ones, someone could have access to them while they're being printed, shipped, and mailed.

Why would someone buy a lounge pass from someone who has already sold 500 of them? To me, just the numbers suggest that they can't be legitimate.