Was his ledger manipulated or compromised in some way before using it? Was the seed already pregenerated? Was the paper actually compromised, or some other system got the data?

There are plenty of other ways.

You keep saying it is impossible the paper was accessed, but that doesn’t mean it wasn’t- or the information got compromised another way.

Did he print it out from a common machine?