> Do you think his story is even remotely plausible, or am I seriously
> justified in thinking he got his hands on the source, then generated
> fog to hide his tracks?

Whether somethink like this is plausible depens very much on the kind of
bug this guy found.
I recently found two bugs in a PAL source within one hour, and I hardly
knew what a PAL was, but I did not have to know that because
the bugs were not related to the PAL but related to the way the
programmer had assumed
the world outside the PAL worked.
And those aspects could easily be seen without understanding all the
details.

Translated to your situation I would not believe the guy when the bug
was some PIC-specific like the famous IO port read-modify-write or the
saving of registers
in the interrupt in a banked-memory PIC, but I might (just might) believe
him when the bug
was an I2C protocol error. It is far easier to decode which protocol an
application tries to
use than to check whether the implementation is 100%.

regards,
Wouter.