It's a "don't ask, don't tell" kind of thing. Google isn't too big on this issue.

They certainly got into the program with some other site and now using their codes on those sites. Until someone reports and/or they get caught that is.

Oh come on... Are you sure it's Adsense they're using? There are many other contextual ad networks that sort of "don't care" and look a lot like Adsense. If it really is Adsense - it won't be long until they either get banned or replace Adsense ads with something else.

Their offence is on the minor side of the scale. Google is more concerned with publishers who engage in click fraud and the likes.