The moment there is software or a bot involved you know it’s Black Hat SEO, there is no “hack” about it, because once google sniffs out those dodgy links out (how? They look at what we call link velocity, the rate at which you are picking up links, and other stuff like where those links are coming from etc and can tell if it is unnatural )
Make sure you have installed and set up the Google Search Console for your website because very soon you will be getting a “special” message from Google about the black hat stuff he is doing. This, you can use to get him fired – but just warn your boss first to say, I believe this guy is doing SEO techniques that are banned by Google and Bing.
If he challenges you, asks him to take the Google webmaster guidelines and list what he has done for your company and either defend or acknowledge any violations! (Most like he won’t even bother and will just ignore and say he is sticking to The guidelines)
If Google are as smart as SEOs make them out to be, he won’t see any results soon which will lead to his downfall eventually