It's only legitimate so long as it isn't used to circumvent ITAR. The seller would probably not sell to him directly because exporting flight manuals for military aircraft was paper work the seller didn't want to deal with. By obscuring his identity through a third party the buyer violated ITAR, the seller probably also did as well by not doing proper due diligence.