Because it's a scam and likely malware infected.
What you describe is impossible, each stratum connection only accepts hash produced
from the unique data it sent. It's invalid for any other stratum connection.
In fact what you are describing is a man in the middle attack.
https://en.wikipedia.org/wiki/Man-in-the-middle_attackIndeed this is impossible. We have software that detects if something like this is running and we ban the miner.