If the pirate attempted to use an existing ISBN (required to match up the listings) I am pretty sure Createspace would automatically flag it [ETA: Not so sure anymore. See http://www.kboards.com/index.php/topic,248831.msg3466774.htm...]. There is no Amazon or Createspace branding applied to the book; the only clue that it’s POD is a barcode on the last blank page with “Made In USA” (digital short run and offset do not have to do this).
Another POD service, Ingramspark, also feeds into Amazon via third-party sellers but there will definitely be a block if an existing ISBN is used.
Another possibility is the pirates are using the POD services and a different ISBN, then make the Amazon listing using the original ISBN and ship the copy themselves (that is, not using fulfillment by Amazon). They could sticker over the bogus ISBN or not; nobody except for victims bothers to check.
Or, perhaps the pirates are using a cheap independent digital short run service and put whatever they want on the cover (printers don’t care) and then sell it on Amazon as the real thing.