They're reselling pooled capacity from many Max accounts through Chinese proxies at below official prices:

https://www.chinatalk.media/p/the-grey-market-for-american-l...

Account sharing. They route your request via one of thousands of Max 5X accounts.

Maybe from all those stolen API keys?