Yup, but you still do not get what I am talking about. Anyone who hold KARM for 30 days is eligable for payout. What I am telling is, exchanges have probably 30-50% of all KARM coins in their wallets. There is no way how to distingvish between my personal wallet and the wallet owned by exchanges. So exchanges can have for example 1000 cold wallets and in every wallet 30 million KARM. And they can ask for payout, since they are holding coins of other people on their wallets. There is no way how to find out which wallets are owned by exchanges and which are owned by people. So this means, the idea was to pay KARM belivers and KARM holders. But the fact is, biggest KARM holders are exchanges, they hold people's coins. They will ask for payout thanks to the coins they do not own, but they hold them. Do you understand what I am talking about? They will get payout using others people KARM.
OK there is no 100% fool proof method for determining which wallets are exchange wallets and which are personal.. but just by looking at the addresses it should be pretty easy to determine which ones are likely to be owned by exchanges.. just by the size and sheer number of transactional volume they generate.
the thing about exchanges is that their wallets are always in flux so the coins are unlikely to stay in one address for more than 30 days unless they are moved into cold storage.
the other thing to consider is that in order to claim your karmashares you have to actually send a signed message from your wallet.
this means that someone in the exchange would have to sign with the cold wallet + their email address to claim the karmashares.
access to cold wallets (even for employees) is something that most exchanges do not allow for obvious reasons.
also if anyone was discovered cheating then their karmashares could easily be voided.
so you are right when you say there is no way to guarantee that an exchange isn't cheating and claiming Karmashares, but given the circumstances I would say that it is highly unlikely that they would or could do it easily and even if they did, it would be quite easy to spot and remove them from the list of karmashares holders. (because the Karmashares list is controlled by Karmashares LLC)
as far as an exchange getting a payout using someone else's money is concerned.
technically this is not possible because when you send your money to an exchange it is not your money anymore so you don't have any rights to claim karmashares with it anyway.
I think this is the key point about Exchanges and Crypto currency that most people do not understand... if you don't control the private Key.. the money is not yours.
All the coins you think you own on an exchange are just IOUs and you hope (and sometimes pray) that when you want to withdraw those coins the exchange will actually honor those IOUs and give you coins in return. Most people do not realize that.
Just like in a casino, those plastic exchange tokens aren't worth anything until the exchange gives you real coins when you request a withdraw.