Joined 12 years ago
Typically the keys come from legitimate promotions such as the Humble Bundle, but purchased (as you said) with stolen card details.
[0] http://www.pouet.net/prod.php?which=76627