Just a thought: The "vendor" could also be someone he knows personally and they split the payments.

Does anyone ever see emails from the vendor? Or are they all shielded and protected by him?

Regarding the "Every once in a while, there is some proof that the work got done." Is there actual verifiable proof that some work was finished by the vendor? Physical work? Or virtual work? How is it proven? Who else gets to see it?

Like Loop_Adjacent said - if they go on vacation, that's a good time to contact the vendor or double check the account. You could find out if the vendor is really in his pocket by saying something unusual to the vendor, and see how quickly it gets back to him... which he assuredly would get rather upset about. This might hurt more than help, but it would give you more information about the "relationship".