He didn't. He managed to doublespend a previous transaction and by doing so tricked them. But the most recent one failed and was confirmed before he successfully doublespent it. CoinGate now has the 20 GBP worth of bitcoin and they won't refund him unless he complies and undergoes thorough KYC verification. In other words, unless he sells his identity to them for 20 GBP, he isn't getting his BTC back.