I started smelling something odd when the site wanted my personal info in order to let me download the report.

In general though, I find the claims plausible, but what sort of access did he & his organization have as outsiders? It's not like they had full audit access. Access of publicly accessible documents doesn't seem like it would be enough.