Don't take this as any kind of official advice, but I'd just reach out to the company. It may not be a bug/exploit. It might be that anyone can give a YC company name but they check during the registration process that you're legit and entitled to the credits. I have no idea, just suggesting an explanation.