Actually Park.io has reseller access to nic.io which anyone can grant access too application here -
http://www.nic.io/applyinstrs.html; The names that are not back ordered directly through nic.io and caught through Park.io system is done through api access through the nic.io reseller program.
When a backorder is processed Park.io script pings the nic.io registry with a
EPP code - Extensible Provisioning Protocol key which tells nic.io which names to process for order. Since his script is setup through API to Ping the registry at the time of drop a Ping can execute in milliseconds; typically can execute and process the order every millisecond so the registry can be pinged 20-30x within a second at the time of drop ensuring Park.io the domain - This beating manual registration process.
If the domain is already backordered this means Park.io may have already took the back order so he is guaranteed the drop in case anyone else will look at his list and Bo it before he does.
When you place an order with Park.io your domain is not in your account; it's always held under Park.io nic.io registry account Simply changing the whois on the domain to match the Purchasers name; which in my opinion is terms of invalid whois since not in correct owners registry account. But it is what it is..
To collaborate a little more; think about what that means, he can control the whois, renewal dates, and renewal prices which he charges 3 months in advance for around $69-75, He could take his service down and All this purchasers names are under his registry account. He could literally shut down his service and Run and take everyones names. I'm sure this won't happen or would be an issue but anything is a possibility.