If they've already awarded him these $50k, congratulations and they should probably close the project down. They've failed basic validation of inputs before transferring $50k to a fradulent competitor.
You do not fail that hard by accident. It speaks of prolonged negligence and as I've said elsewhere, their whole portfolio needs to be rechecked.
As for research ethics, not everybody is a researcher and thus has the same ethic. For me the guys who get bogus computer-generated articles through reviews and into journals are genius, even though people with research background may see that as a violation. Tough life.
