How can a Complainant prove that the lessor/seller back then registered the domain in bad faith?
It would probably be enlightening for you to subscribe to the daily WIPO UDRP decision email service to become familiar with the ways in which these things are decided, and what kinds of things are used to make those decisions.
https://www3.wipo.int/newsletters/en/#domain_names
Because these things tend to be fact-dependent, an abstract question like yours has no answer other than "on the facts, and what will be inferred from them."
For example, lets say that there is a company that provides financial services called "STAIRCASE". They launched in 2010 and registered a trademark in 2014.
You register the domain name staircase.com in 2018 because it dropped at auction and it is a generic word. You then put it up for sale or lease.
Someone leases the domain name from you in 2020. They use the name to provide financial services in competition with the trademark owner.
So, here's the way the case looks:
The Complainant has a longstanding mark for STAIRCASE for financial services. The domain name is obviously being used to infringe the Complainant's mark. The Complainant states that the fact it is being used to infringe their mark is evidence of bad faith intent in having registered it in the first place.
(Now, I'm going to stop here and discuss the word "evidence" for a second, because most people do not actually understand that word. Evidence is something which, if shown, makes a given conclusion either more likely or less likely. "Evidence" is not the same thing as proof. If, for example, a bank was robbed five minutes ago and I am pulled over for running a stop light somewhere near the bank, and I have a lot of cash sitting on the seat next to me, then that is "evidence" that I may have robbed the bank. Of course, it could be that I just happened to be driving by with cash on my seat. That is the difference between "evidence" and "proof".)
Okay, so, the domain registrant is going to respond to that with "I didn't register the name in bad faith. The guy who rented it merely used it in bad faith."
That defense is most likely going to lose. At best, you didn't care what the domain name was going to be used for, and you are getting paid, in part, from the proceeds of the infringing business being conducted there. The UDRP defense of "Yes, it's being used for an unlawful purpose but it's someone else's fault and was not my intention" has a long history of losing. Saying, "The thing that happened within my control is not the thing I intended to happen" is, already, an uphill battle, given the usual inference that "what people did" is what they intended to do.
But the bottom line is that the evidence shows the domain name is being used for an infringing purpose, from which one can infer intent. Against that evidence, you have the person responsible saying, "I didn't mean for that to happen" without any evidence otherwise.
Then, there are the examples in the UDRP itself:
------------
b. Evidence of Registration and Use in Bad Faith. For the purposes of Paragraph 4(a)(iii), the following circumstances, in particular but without limitation, if found by the Panel to be present, shall be evidence of the registration and use of a domain name in bad faith:
(i) circumstances indicating that you have registered or you have acquired the domain name primarily for the purpose of selling, renting, or otherwise transferring the domain name registration to the complainant who is the owner of the trademark or service mark or to a competitor of that complainant, for valuable consideration in excess of your documented out-of-pocket costs directly related to the domain name; or
------------
So we have a situation here in which you have rented the domain name to a competitor of the trademark owner, and you are going to argue this is not a circumstance indicating you acquired the domain name in order to rent it to a competitor of the complainant. I'm not saying that is an impossible task, but it is obviously going to be an uphill battle.
Given the fact that the domain name was being used to infringe the mark, you'll need to have something better than "that's not what my intent was when I registered the domain name" because the subsequent use of the domain name is evidence of your intent. We usually assume that people are doing what they intended to do by the fact that they are doing it, absent some tangible reason to believe otherwise - and certainly more than a self-serving denial.
The standard here is not some standard of absolute truth. Nobody can know what goes on in someone else's head. The standard here is "What a UDRP panelist is going to believe is more likely or not". If it looks like a 49% chance you acted in good faith, you lose.
"How does one prove intent?" is a question that comes up in much larger contexts than just the UDRP, and is frequently raised in the context of not having had a lot of experience in legal disputes involving intent. Needless to say, it is not a big deal in the context of criminal law where things like "possession of (illegal substance) with intent to deliver" is one of the most common criminal charges.
Finally, the "I didn't intend for the thing that actually happened to happen" defense is further viewed as an opening to an end-run around whatever rule is involved. Applying it to the UDRP, you can have a whole ecosystem built around infringers renting domain names from registrants who can all claim that's not what they intended to happen.
Again, there are arguments that might involve the overall timing of events, the degree of distinctiveness of the mark, and other specific facts that could cause a case to go one way or the other.
But let me ask you something....
You go into a store and pick up a piece of merchandise. On your way to the checkout, you meet an old friend and chat for a while. You completely forgot you hadn't paid. You walk out of the store with the merchandise. You are arrested in the parking lot for shoplifting.
Now, sure, you did not intend to steal the merchandise. That is the truth. What do you think the likelihood is that you are going to avoid a conviction for shoplifting just by saying, "I didn't intend to do that."
How are they going to prove you intended to steal the merchandise? Simple. You walked out without paying for it. That's how.
And, sure, after anyone is caught shoplifting, they are going to say exactly what you are saying, "Oh, I forgot to pay, it was just a mistake." You are going to need more than that.