It would be utterly stupid for them to ban the whole account. Valve just removes the game from your library if the key was stolen, etc.
Does GFWL have the ability to revoke keys however?
If that's the case then we'd be seeing ALOT of posts like this... Now if it involved some Credit card fraud then this makes a lot more sense...
It depends on how these keys were obtained, if it was through a stolen credit card, chances are he used this on his live account aswell
EDIT: It wouldn't be a permanent ban for Achievement Boosting, I boosted some Halo Reach achievements (DLC achievements are now extremely hard to get as they don't come up in Matchmaking and I was bothered about my gamer score ending in 2) and all I got was a ranking ban from the game for two days if I'm remembering, I could even still play online, just wasn't earning anything for it