When the purchase on their web-site are completed, the site manager requires a steam account and password along with their unique key disguised as a steam key. They ad their key is the original steam key, however, it's false. It's just a lie to reassure buyers. And then they connect to that buyer's account, change the country settings - We don't know this detailed process -, and they buy our game at a low price.
We know that if the buyer's bypass purchase caught by Steam, steam ban the buyer's account. However, we understand that the ban process is irregular and does not apply to 1 to 2 attempts. We're going to ask Steam again about this.