Most plausible explanation is that an original code was found, and sold to a site/someone with a code-bot that re-creates similar algorithms as said code, some worked, some didn't, and are thus being sold.
That's how all codes are created AFAIK. I'd say 10% are actual PAX codes from said event, 20% given by RIOT for winning competitions, etc, and the rest bot generated.
However, their life will be limited, meaning, the bot generated codes cannot surpass the actual amount of authentic codes/PAX cards produced for said events; so these skins will still always be relatively rare.
I.e, if RIOT produced 400 PAX Sivir codes for an event in 2010, and only 150 were distributed/used, then the remaining 250 can be created by said bots. However, once the threshold of 400 is reached, no more can be created, and thus, skins are rare.
This is what I think anyway, and what others have told me.
Everyone understand?