Well, that's the point, innit? Until someone gets these jokers into a court of law or even into arbitration, there is no way to find out what they're actually doing. We're all just guessing without knowledge. My point is that the mechanism to gain knowledge IS to go to court; you can't magically find that evidence before you go to court unless there's a whistleblower.
The problem is that even with a court order you may not find out much.
I mean that since these problems occur pretty rarely, it's clearly not something the business does it, hence in the "best case" it's a developer that will do this for short time, remove his traces and move on.
The "worse case" for you, the case that will be blamed officially is the user being sloppy, not taking care of his seed/keys (like storing in mail or cloud), clicking into phishing, or having malware on his computer.
...I honestly can't see any way you would have the tiniest chance to win this... (and I'm clearly not their supporter either).
