Maybe it is a cracked version of the game that shows the data it wants and not data from the server. It can be a sofisticated version that selectively alter your game experience so that you "believe" you own certain items while in reality those are not really purchased (and at same time if you make a real purchase it could be redirected to other developers).
This would be harder to implement (so maybe a big company trying to reduce Go incomes by preventing real purchases? and at same time increasing Go's servers load). This could be a reality because I think no game in history had so much success. Actually you can see most online games have a drop in connected users in the days following release of Pokemon GO, so it is likely there are lot of angry developers because of that.
How do a virtual game works:
You believe you actually make purchases and get upgrades, in reality it is just emulated on your app, while you still connect to server to get some real data, from the server point of view your are just a non-paying player that is using bandwith without purchasing anything.
Note if you incurred in a virtual game, your game credentials already got leaked. Better you change password for GO.
To see if I am right, you should just download the official package and see if you have all the progress that you had on the other unofficial app (warning you could already lose lot of data, which never existed server-side).
It could also be pseudo-official App to track usage of cracked versions (maybe released by developers, when they see you have more than 300 items they know you use a cracked app, and there's no need to send any plain text "Hei I am using cracked app" because they can deduce that).. It already happened in history that developers release cracked versions to find where actually their games get downloaded and pirated, don't know if that is the case.
I may actually be true:
Just found a GO's APK and monitored network traffic with wireshark (used laptop as wi-fi router): when consuming items no network message is sent with the unofficial APK, meaning those are just consumed on "client side".
When Instead I was using the original package items were consumed properly.