If he's been to the shop multiple times in the past to "test" ride bikes, and each time they held his I.D., maybe he's just been trying repeatedly until they forgot to ask for his I.D. This time he did it right--by going in when the staff was so distracted they forgot about his I.D., and he made off with a bike for once. Try, try again...

I also wonder if that I.D. he showed in the past was even legit.

I've bought a few parts off eBay in the past--even recently--and it's always claimed they're taken off a new bike to be replaced with better parts, or slightly used and not liked. I do my best to ignore my inner thoughts that every bike part on eBay might be stolen, but there's a high chance most of them are, unfortunately. After saying that, though, I've also sold quite a few parts on eBay off my wife's bike when I replaced them with better (lighter) stuff, so at least there's something being sold on there that's legit.