He sends a lot of invalid transactions. And then gathering tokens from addresses. Check his transactions https://etherscan.io/address/0xaddf8349c955fc82e9549d397fd1b0a72a08b3bf