If it's stolen how will the keys still work ? wouldn't MS banned the key ?
Well lets put it this way, how do you think these sites can continually sell basically everything cheaper than retail? Especially things that virtually never, or absolutely never, go on sale?
There's actually three answers, theft, resale and russian copies. For whatever reason, russians pay less for games than anyone else. A lot less. So it's not uncommon to see russian keys sold, with methods to make the game english if necessary.
A lot of these sites buy or obtain keys from various 'sources', and there's really no shits given where the key was obtained, or how.
As one example, many, many of those CDkey sites (even the most popular and 'reputable') were selling Founders packs for a new MMORPG called Archeage. They were undercutting these Founders packs by about $20-40. That's a little weird isn't it? Founders packs for MMOs don't typically ever go on sale (I believe Landmark was the one and only to do it), and I for one know for a fact ArcheAge founders packs had -never- been discounted.
Another off the top of my head would actually be Sniper Elite 3. It had a big issue with one of the retailers informing the company that many of their Steam keys of the game had been stolen. Bit of fuss over it, google it if you want the details.
Mostly focused on games but it's the same dealio for MS points and the like.
If you wanna know HOW they do it...not a clue. Google it? I'm not savvy with the technical side of things, i've just been around grey and black gaming markets for a while.
TBH it's not hard to just not think about the why or how. Just grab some cheap points and be happy with your savings.