I think it would be entirely possible for a client to be made to constantly maintain a =1 ratio. Highly unlikely, as I assume most people want there downloads right away and want to seed later, but nonetheless possible.
In this case, odds are the person isn't hacking. No hacker (at least in their right mind) would go through the trouble of hacking a client only to download only 2-3 torrents. They tend to want to download as much as possible before getting caught.