I've done some tax work. It happens because folks simply supply fraudulent information and the IRS does little or nothing to verify the tax returns claiming all the EITC and child credits.
If someone has a legitimate W-2 for several thousand in earnings, they just add the phony dependents and claim the credits.
Aren't SSN's required for all dependents? Aren't those numbers verified and checked to ensure that they're not used more than once? Surely, the IRS has computers sophisticated enough to do this?