You are right.
Since it is in his name and more than likely connected to his email accounts,
he could infact, take it back with just claiming it was stolen to begin with.
Very risky to be buying into a business that is dealing with virtual goods.
What proof would you have as a claimant if anything were to go wrong?