Would it have been possible they were given shares by another player inside the corp that does have shares? Although I'm sure share transactions are logged and public information, if not through the game then through the APIs, and most Corporations will make some API access required.