This would normally be a Quick Question, but I'll answer this for you here and just lock the thread.
Nintendo does its very best to keep the Wifi gaming clean of any hacks what-so-ever. Though your boyfriend may have not hacked the stats, there are a multitude of other things to look for. Secret ID, Trainer ID, where the Pokemon was obtained, what level it was obtained on, how it came into your possession, WHEN it came into your possession, the nickname, the item, the level, the moves, the ribbons, etc etc. Nintendo has gotten a lot more thorough in checking for illegitimate Pokemon. The reason for this is that they want to make sure everyone has a fair chance to play against one another, regardless if the stats are correct or not. If you have any further questions, please use the Quick Questions thread at the top of this page, or PM me and we can discuss whatever you may need.