I'm slightly surprised they haven't chased him for the extra money too (which is presumably the only reason he did it in the first place?); it's fraud, after all.
Not my field, but I'd be surprised if there wasn't a data protection issue around away clubs giving BHAFC ticket scanning data. At no point in the process is the data BHAFC's, imo. When they sell the tickets, they're acting as an agent for the away club.