Comment by WillKirkby

Exactly this.

Typically the keys come from legitimate promotions such as the Humble Bundle, but purchased (as you said) with stolen card details.