As for evidence: I started to get suspicious when I noticed that coins I sent to Ian were moved in July this year. And from the history of that address, it seems like it was one of Ian's pooling addresses.
Well at least from the SEC document we know that pay.btc was a real pass-through. It could still be though that Ian kept some coins for himself when it was clear that things would collapse.
That would not surprise me at all. He may have ended up with a lot more than he started with - he seemed a little worried about clawback...