how did he discover this ?

The fake-PR checkers generally rely on using the Google "info:" trick. But that's easily fooled by redirecting, waiting for the fake PR to kick in, removing the redirection, and waiting for Google to index the non-redirecting site. There'll be a window of opportunity created by the delay in updates of Google's toolbar PR, the API for which the PR checkers use.

There are a couple of fake PR10 sites on Flippa at the moment, both created using 302 redirects to legit PR10 pages:

maars.com --> addthis.com/bookmark.php
thealcoholwithdrawalsymptoms.info --> coimbra-group.eu

Sometimes you can catch the redirects on web.archive.org:

web.archive.org/web/20130115085437/http://www.thealcoholwithdrawalsymptoms.info/

That's not foolproof, though. Nor is relying on Domain Authority and Page Authority.

PR10s scream fraud. The real danger is when buying, say, PR3s and PR4s. There you have to analyze the backlink profiles meticulously and could still end up fooled.

What's worse is that the sellers get some plausible deniability. They can act all retarded, as if they've been conned themselves. The person selling maars.com is doing that, unaware that his/her auction win in Feb 2013 (according to provided screenshots in earlier listings of maars.com) doesn't help the whole "conned me" act when the 302 redirect was in place as late as Apr 2013.