I basically have three options I can hit them with if this happens:
1

If someone tries to tell you that the code you sent them doesn't work, you just tell them "OK sir no problem I will just ring Microsoft to find out when and where that code registered" At which point said scammer then realizes that if I does ring microsoft and they tell me the code was registered 10 minutes after I sent the email he's been found out (I have no idea weather MS will tell you this or not i've never got that far)
2

My site T&C's state that they they will be snail mailed a scan of the original code and MS contact details and they are responsible for contacting the appropriate supplier.
3

My site FAQ's state No refunds are given for these.