The developer knows which keys have been stolen from the developer, i.e. ones it has allowed to be used, but hasn't received revenue for, possibly because of a

The developer knows which keys have been stolen from the developer, i.e. ones it has allowed to be used, but hasn't received revenue for, possibly because of a credit card chargeback. It doesn't account for, e.g. having your laptop stolen with the games installed on it, or charged-back keys that were never used. But the developer knows about much more than "a tiny sample" of the thefts that actually affect it.