Shahmir Sanni has been through the wringer. When I saw him two months ago, he was subdued, downbeat, self-critical. He has played a consequential part in British history, but it’s come at a high personal cost.

Sanni is the 24-year-old who in March came forward to the Observer to blow the whistle on what has been proved to be massive overspending by the official Brexit campaign, Vote Leave.

Last week saw him be totally vindicated. On Tuesday, the Electoral Commission found Vote Leave guilty of breaking the law – multiple laws – and has referred those it named as responsible to the Metropolitan police. The thrust of Sanni’s account of events – and a dossier of evidence he submitted to the Electoral Commission – was confirmed to be correct. And its ruling confirmed the role he had in exposing one of the country’s greatest electoral scandals.

When I see him on Tuesday, he’s pleased that he has finally been allowed on the BBC. And he’d scored a direct hit against Tory MP Nadine Dorries on the Daily Politics: “What we are looking at here is literally the law versus someone’s opinion. Whose side are you on?” He’s relieved more than triumphant, and when I see him again the next day, he’s pensive, subdued. It’s not a victory. “Nobody’s in jail,” he says. “Nobody’s being called to account.”

He, on the other hand, lost “pretty much everything. My job. My friends, my career. My privacy. My sense of the future.”

On 24 March, one week after we published Christopher Wylie’s explosive revelations about Cambridge Analytica – how the data analytics firm that worked with Donald Trump’s election team and the winning Brexit campaign harvested millions of Facebook profiles of US voters, in one of the tech giant’s biggest ever data breaches – Sanni stepped into the limelight to tell another, connected part of the tale: how Vote Leave broke the law during the EU referendum by exceeding legal spending limits.

And if Wylie had the dream whistleblower experience – global attention, huge impact, front page follow-ups, invitations from Congress – Sanni had the nightmare.

He had been a volunteer for Vote Leave, and as the Electoral Commission ruled last week, that organisation had “exceeded its legal spending limit” and “returned an inaccurate report”; there had also been found to be “significant evidence” of it working together with the youth-oriented Brexit campaign group BeLeave.

The watchdog said it had imposed punitive fines on Vote Leave because it said the group had refused to cooperate fully with its investigation and had declined to be interviewed.

Sanni says: ‘I don’t think the majority of the public or parliament got this. They don’t understand the gravity of outing someone who is a Pakistani Muslim.’ Photograph: Katherine Anne Rose/The Observer

Sanni had no idea any of this was illegal at the time: he was fresh out of university. But he took the decision to come forward the week after Wylie. “We were doing it together. We were two individuals who had seen wrongdoing. It was still Facebook, still connected to Cambridge Analytica. The difference was that my story was very deep and integral to Britain. And …”

He doesn’t finish the sentence. But the “and” is that it triggered a monumental backlash. Sanni ran up against the combined forces of the British establishment. On the day we published his story, one of the directors of the campaign – Stephen Parkinson, the national organiser for Vote Leave, and now Theresa May’s top political adviser – issued a statement that Dominic Cummings, the campaign director for Vote Leave, published on his blog. The blog revealed that Parkinson had been in a personal relationship with Sanni and that Parkinson could understand “if the lines became blurred for him”.

In the Observer’s office, we read it in horror. We knew that Sanni was gay and we’d talked to him, as had his lawyer, at length about the risks of talking to the press. He wasn’t out to his family and he said he couldn’t be. He had family in Pakistan, including his sister, where people are killed for being homosexual.

Sanni’s lawyer contacted Cummings and he took down his post, but it was too late. A journalist from the New York Times approached the prime minister for comment, and a press officer for 10 Downing Street sent him Parkinson’s statement as an official comment from Theresa May.

Parkinson has since said: “I cannot see how our relationship, which was ongoing at the time of the referendum and which is a material fact in the allegations being made, could have remained private once Shahmir decided to publicise his false claims in this way.”

How do you feel about the issue now, I ask Sanni. “About the violence?” he says. “Let’s call it what it is. The Home Office says people get killed for being gay in Pakistan. This was an act of violence. But I don’t think the majority of the public or parliament got this. They don’t understand the gravity of outing someone who is a Pakistani Muslim. If they did, Theresa May would be out of a job.”

Sanni had to come out to his family that night, “though my aunt and uncle in Birmingham found out by a Mail on Sunday journalist going up to them and asking them what they think of me being gay”.

Hours later, the Mail on Sunday published a banner headline across its front page: “PM’s aide in toxic sex row over pro-Brexit cash plot”. Boris Johnson tweeted that the whole story was “ludicrous”.

I’d spent a year talking to Wylie at this stage and had encountered him in all moods, but when I rang him that night, I’ve never heard him so angry.

“What you don’t understand,” he told me, “is that this only happens once. You only come out to your family once. To rob someone of that moment, it’s … such an assault.”

Sanni was still in shock, confused. “I just didn’t think he’d do it,” he told me on the phone. He’d been in a proper relationship with Parkinson – a much older man he had looked up to. “He knew all about my family. He knew the impact of this. I just really didn’t think he’d go there.”

It was well past midnight when I spoke to them; Wylie was trying to persuade Sanni to go clubbing. “He has to reclaim it. This can’t be about something that is done to him.”

Four months on, Sanni is still bruised by the episode, angry about it. He has a wonderfully supportive family – his mother and sisters in the West Midlands. “But I still wish I could have come out on my own terms,” he says.

“I’m glad my family knows now, but the way it happened – it wasn’t honest. It wasn’t me saying, ‘I love you guys now enough to tell you everything.’ It wasn’t me saying ‘I’ve accepted myself in a way that I feel comfortable sharing with you’.”

“I was numb from the shock of it. I was like ‘What’s the point?’. I thought my family was going to get shot in the head anyway, so I might as well die too.”

Next week he is travelling to Pakistan for his sister’s wedding. Will he be safe? “My family have arranged some security. I don’t know. I think it’s OK, but maybe I’m kidding myself.”

He still shudders when he mentions the Mail on Sunday front page. But the worst thing about the whole incident was that it worked. He did a couple of brief appearances on daytime BBC politics shows, and that was it. The smear worked. The effect of outing him wasn’t just a monumental intrusion on his private life: it also effectively silenced him.

I felt a measure of the frustration and anger and sadness that Sanni has gone through – and a sense of responsibility too. He’d given up so much to come forward, but the story was too difficult for much of the British media, too close to home. It wasn’t like Christopher Wylie’s story, where everyone was united in kicking Facebook. It was trickier, because Brexit is trickier. Although it’s part of the same story: it was about tech giants, technology outpacing the law, and a Canadian company through which Vote Leave funnelled money and data, and which is intimately tied to Cambridge Analytica, as the Information Commissioner’s Office has now confirmed.

Michael Gove and Boris Johnson during the referendum campaign in 2016. Photograph: Stefan Rousseau/PA

Last week’s ruling “was important, but it’s not justice,” says Sanni. “Those MPs who used to come into the office – the leaders, Michael Gove, Boris Johnson – how could they not know what was going on? ”

He always thought that Darren Grimes, then a 22-year-old volunteer for BeLeave, would be the one to carry the can. And so it turned out. “I said that in the first article, didn’t I? I knew that would happen.”

Grimes has been referred to the police by the Electoral Commission because his name was on the documents, though Sanni had always made clear that they were both student volunteers who simply did what they were told.

“He has such a good heart, Darren. He was my best friend. He didn’t say anything when I was outed and that hurt, but it’s just a shame he didn’t feel able to come forward and tell the truth.

“I have a very strong family and I was able to make the break from these people, whereas it seems they’ve become his family. ”

A “family” that is made up of a network of opaquely funded organisations that centre around Matthew Elliott and the TaxPayers’ Alliance – a pressure group that he founded – and Brexit Central, an anti-EU website of which he’s now editor-in-chief.

Sanni took the decision not to take what had happened to him lying down. He has launched a claim against Downing Street and he’s also suing the TaxPayers’ Alliance over a claim for unfair dismissal. He was working for them when he came forward to reveal illegal activities by Vote Leave. In the immediate aftermath, they asked him not to come into the office. And then they sacked him, even though whistleblowers are safeguarded by law in Britain under the Public Interest Disclosure Act.

The TaxPayers’ Alliance said it “acted at all times in a fair and correct manner”, adding: “We reject (and will be defending) the claims Mr Sanni has made.”

The papers, filed by Sanni’s lawyers on Wednesday, claim the TaxPayers’ Alliance is “one of seven organisations located at or with links to 55 Tufton Street who each pursue different strands of the same political goals. One of these is the exit of the UK from the EU.”

There’s a revolving door between the TaxPayers’ Alliance, Brexit Central, the Institute of Economic Affairs, the Adam Smith Institute, the Global Warming Policy Foundation and Leave Means Leave. For example, Elliott founded the Alliance, was chief executive of Vote Leave, and is the editor-in-chief of Brexit Central. Grimes has gone from Vote Leave to Brexit Central to the Institute of Economic Affairs.

Was it worth it?, I ask him. “I guess it was,” he says unconvincingly. “There’s what I lost in the process. That’s priceless. I wouldn’t recommend anyone else to do this. But especially if you’re gay, Muslim, Pakistani.” And then he says: “I need to turn this into something positive.

“Maybe that makes me sound bad, but my main point that I tried to maintain throughout this whole process is that I needed to be 100% honest. And I’m honest about even the things that people might see badly. I’m trying to figure out how to use this to my advantage because right now I’ve experienced only loss. And I don’t deserve anything in return. This is me doing my duty. But there’s also a part of me going ‘what do I do now?’.”

Darren Grimes in 2016. Photograph: BeLeave

In the short term he’s off to the wedding. What are you going to do there, I ask him. “There’s a voter mobilisation programme I want to help with,” he says. And then: “And also get some clothes made.”

It’s that unique mix – democracy and a bit of fashion – that is the trademark blend of Wylie and Sanni, the millennial whistleblowers. Although it’s what he says next, talking about returning to Pakistan during this week’s elections, which puts that in context.

“It’s why I’m actually scared. Last week, 120 people died. There’s a video going viral that shows a donkey’s head being cracked open because the symbol of one of the parties is a donkey.

“It’s so extreme. And Facebook is making it more extreme. It’s being used as a platform to spread extremist ideology. And young liberal Muslims trying to fight it. And it’s all becoming more extreme, more violent. I really think there’s something dark going on with Facebook there.

“And this is why. This is why I’ve been constantly saying: ‘Guys, value democracy.’ I genuinely in the sincerest part of my heart think that if we don’t tackle these issues, in a few years you’ll have people beating donkeys by the side of the road and killing each other. That’s what happens when you don’t respect the law.”

That’s what is so infuriating about the reaction to Sanni’s story. Because he didn’t blow the whistle on Brexit: he blew the whistle on lawbreaking. Lawbreaking that was enabled because of the weakness of our electoral law in the face of the all-powerfulness of the tech platforms. “It’s absurd to think that didn’t have an impact,” says Sanni.

His revelations were pushed to the margins. The BBC has no convincing answer to criticism of its lack of coverage. The prime minister’s office was implicated in the cover-up. The directors of the campaign haven’t suffered. Cheating on a scale not seen this century has been exposed – and almost nothing has happened. Nothing, except a kicking and a bruising for Sanni.