Report this activity to your boss, before you get fired. present him with the options i.e: 1)this much money to buy software plus X amount of time for set-up and configuration, to catch'em red handed 2) find another reason to fire.
What the hell are you waiting for, get rid of 'em. What if some of that info being sent hurts the company you work for, you'll be responsible (morally) for any job losses resulting from this, because you didn't act. You need to cut it in the bud, not play games.
