Yeah, sorry. 3rd party, not from Marriott.

I suspect this because

1) He received 100K points which is the max amount you can receive from an individual person (I believe the total max per account is 500K)
2) The remaining amount of points in his account is in an increment of 100K (200K)
3) He said his account was "audited" which, IMO, means they probably tracked back the source of his points and the activities of the accounts sending him points.

I suspect he either has multiple accounts (to get around the 500K max per account limit) or just got caught buying points from third party seller.